troll-coin[.]app

PhishDestroy identifies troll-coin.app as an active crypto drainer masquerading as a legitimate 'Troll Network' platform. The domain is designed to trick users into connecting their crypto wallets, where threat actors can silently drain funds under the guise of a 'network' or 'coin' offering. Blocked by MetaMask, this site resolves to IP 188.114.97.3 and holds a Let's Encrypt SSL certificate, which adds a false sense of legitimacy. With only 1 out of 95 security vendors flagging it at the time of discovery, the domain’s recent creation date of May 10, 2026, suggests it’s a fast-moving threat actively evading detection. This domain was flagged by PhishDestroy due to its affiliation with a crypto drainer campaign, confirmed by its inclusion on one security blocklist and its attempted evasion tactics such as recent registration through NICENIC INTERNATIONAL GROUP CO., LIMITED. The low detection rate on VirusTotal highlights how new or niche malicious domains can slip through initial scans, making them particularly dangerous for unsuspecting users. Its deceptive page title, 'Troll Network,' further reinforces its aim to impersonate a legitimate service, capitalizing on trends in crypto and meme-themed projects. If you visited troll-coin.app, disconnect your wallet immediately and revoke any permissions granted to unknown domains via your wallet’s settings. Do not interact with pop-ups or prompts, and scan your device for malware using trusted security software. Report the domain to your wallet provider or relevant cybersecurity platforms to help block its spread. Stay vigilant—always verify URLs, avoid unsolicited links, and use hardware wallets for sensitive transactions.