waronusd1-rewards[.]com

The domain waronusd1-rewards.com has been identified as a brand impersonation phishing site specifically targeting CoinMarketCap users. This domain is currently offline, having been taken down after its malicious activity was detected. It was registered through NiceNIC International Group Co., Limited and was created on March 13, 2026, with a page title that reads '$WAR - War on USD | Trade USD1 Pair | Join the Resistance,' which is designed to lure cryptocurrency enthusiasts.

During its active period, the domain was flagged by 3 out of 95 VirusTotal security vendors, indicating a moderate but clear threat. It appears on one security blocklist and was found in two AlienVault OTX threat intelligence pulses, suggesting it was being monitored by security researchers. The domain resolved to IP address 104.21.33.36 and used a Let's Encrypt SSL certificate (E8), which is common among phishing sites to appear legitimate.

Since the domain is now offline, users are no longer at immediate risk from this specific site, but it is crucial to remain vigilant. PhishDestroy recommends that users who may have interacted with this domain check their accounts for any unauthorized activity and enable two-factor authentication. Always verify URLs carefully before entering sensitive information, and report any similar suspicious domains to security authorities. The takedown of waronusd1-rewards.com demonstrates the effectiveness of collaborative threat intelligence in combating cybercrime.