trololo[.]tools

The domain trololo.tools was registered on February 21, 2026 through NiceNIC International Group Co., Limited. It resolves to the Cloudflare edge address 172.67.131.217 and is served from the United States AS13335 (Cloudflare, Inc.). The site returns an HTTP 301 redirect, enforces HSTS, and supports HTTP/3. The domain is currently active and assigned a high risk level.

Infrastructure analysis shows the domain is protected by a Google Trust Services certificate issued to WE1, providing a valid TLS chain. Authoritative nameservers are kelly.ns.cloudflare.com and giancarlo.ns.cloudflare.com. VirusTotal has flagged the domain by 6 of 95 security vendors, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on four security blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—indicating broad community detection.

Content inspection reveals a page title reading “TROLL COIN ON SOLANA”, confirming a direct impersonation of the Solana brand. The threat is classified as a cryptocurrency scam that leverages Solana’s reputation to lure victims. AlienVault OTX references the domain in a single threat‑intelligence pulse, reinforcing its malicious intent and confirming the brand‑impersonation vector.

Defenders should immediately block trololo.tools at network perimeter and endpoint filters, and add the associated IP address 172.67.131.217 to deny lists. Continuous monitoring of DNS resolutions for this domain and its Cloudflare nameservers is advised, as the infrastructure could be repurposed for additional malicious payloads. Incident response teams should alert users about the Solana brand impersonation, advise against any interaction with the site, and incorporate the indicator set into threat‑intel feeds for proactive detection.