waronusd1[.]app

waronusd1.app is an active malicious domain observed on July 25 2026. The site was registered on February 22 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 172.67.183.179, ASN 13335, hosted in the United States. The domain presents a page whose title is “$WAR – War on USD | Trade USD1 Pair | Join the Resistance”, and its SSL certificate is issued by Let’s Encrypt (E7). The page title and the listed scam type indicate a wallet/seed phishing campaign that impersonates the cryptocurrency data provider CoinMarketCap.

VirusTotal analysis shows that six of ninety‑five scanned security vendors flag the domain as malicious, and the domain is listed on three external blocklists. Additional reputation services, such as Gridinsoft, assign a trust score of 0 / 100, confirming a high likelihood of abuse. The domain uses Cloudflare nameservers kinsley.ns.cloudflare.com and tim.ns.cloudflare.com and returns an HTTP 301 redirect, which is also observed by blocklist providers PhishDestroy, MetaMask, and SEAL.

While the page title and registration data provide clear indicators of brand impersonation and wallet/seed phishing, no publicly available content beyond the title has been analyzed, leaving the exact credential‑capture mechanisms uncertain. Defenders should block the domain at perimeter firewalls, DNS resolvers, and endpoint security solutions, and monitor for any attempted submissions of cryptocurrency wallet seeds targeting CoinMarketCap users. Continuous re‑evaluation is recommended, as the infrastructure may evolve or additional payloads could be deployed.