# migratewaronusd.live — SUSPICIOUS

> migratewaronusd.live impersonates WarOnUSD1 to deceive users. VirusTotal flags 2 of 95 vendors as malicious.

## Summary
PhishDestroy identifies migratewaronusd.live as an active brand impersonation domain designed to exploit trust in WarOnUSD1, a cryptocurrency-related brand. The domain leverages deceptive naming conventions to appear legitimate, aiming to trick users into disclosing sensitive credentials or transferring funds under the guise of official WarOnUSD1 services. Security researchers have observed this domain being used in phishing campaigns, particularly targeting individuals familiar with WarOnUSD1’s ecosystem. The threat is elevated due to its direct impersonation of a recognizable financial entity, increasing the likelihood of user deception and financial loss.  

This domain was flagged by 2 out of 95 security vendors on VirusTotal, indicating limited but confirmed malicious detection. It was registered on March 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for accommodating high-risk domains. The domain resolves to the IP address 188.114.97.3, which has been associated with previous phishing and fraudulent activities. These indicators, combined with its recent creation and impersonation tactics, classify this domain as a high-risk brand impersonation threat.  

If you visited migratewaronusd.live, immediately cease any interaction with the site, especially if you entered credentials or payment information. Disconnect from the network to prevent potential malware downloads. Review your accounts for unauthorized transactions and change passwords for WarOnUSD1 and related services. Report the domain to your security team or use tools like PhishDestroy’s database to block further access. Avoid clicking suspicious links and verify websites through official channels before engaging with any financial services.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: WarOnUSD1

## Domain Intelligence
- Registered: 2026-03-11 19:26:21
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 2 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/fc35577c-6b48-404f-82ec-c4ee254c7903
- PhishDestroy: https://phishdestroy.io/domain/migratewaronusd.live/
- LLM endpoint: https://phishdestroy.io/domain/migratewaronusd.live/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/migratewaronusd.live/
Last updated: 2026-03-23