macrocoin[.]lol

As of July 24, 2026 the domain macrocoin.lol is listed as offline but retains multiple indicators of malicious use. The site was registered on February 27, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate is present, indicating that the service is delivered over plain HTTP. The authoritative nameservers are audrey.ns.cloudflare.com and rohin.ns.cloudflare.com, confirming Cloudflare hosting.

The page title returned by the server is the generic string "Just a moment...", and no further content has been captured. VirusTotal reports a single security vendor flagging the domain out of 93 scanners, providing a minimal but concrete detection signal. The domain appears on three public security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the phishing classification. Gridinsoft assigns a trust score of 0 / 100, suggesting a lack of reputable characteristics.

The evidence base is limited to infrastructure and blocklist data; no malware payload, credential‑stealing kit, or brand‑specific lure has been observed, leaving the exact phishing vector uncertain. Defenders should update URL filtering policies to block macrocoin.lol, monitor DNS queries for the associated Cloudflare nameservers, and consider adding the IP address 188.114.96.3 to network‑level deny lists. Continuous re‑evaluation is advised in case the site becomes active again or additional threat intelligence emerges.