waronusds1[.]com

This domain presents an elevated risk due to its specific threat type: brand impersonation targeting WarOnUSD1. The domain waronusds1.com was designed to deceive users into believing they are interacting with the legitimate WarOnUSD1 platform, potentially leading to credential theft or financial fraud. Its status has been taken offline, but the infrastructure remains a concern.

Technical indicators reveal a troubling profile. VirusTotal flags show 3 out of 95 security vendors marking this domain as malicious. The domain resolves to IP address 188.114.97.3 and was registered through Hello Internet Corp on March 25, 2026. It uses a Let's Encrypt SSL certificate with fingerprint E8. AlienVault OTX has identified it in one threat intelligence pulse, and it appears on three security blocklists. These data points collectively indicate a coordinated phishing campaign.

For mitigation, users should avoid clicking any links from suspicious emails or messages referencing WarOnUSD1. Organizations should implement email filtering rules to block domains matching this pattern and monitor for any credential submissions. As the domain is offline, no immediate action is required, but users should remain vigilant for similar domains. PhishDestroy recommends reporting any related incidents to the brand's security team.