warnonusd1-com-d3d5de[.]pages[.]dev

This domain operates as a fraudulent cryptocurrency phishing site targeting users of the War Token, a purported digital asset tied to a 'War on USD' narrative. The site presents itself as an official trading platform for $WAR, using persuasive language such as 'Join the Resistance' to lure victims into connecting wallets or submitting credentials. The primary threat involves theft of cryptocurrency assets through fake token sales, wallet drainers, or credential harvesting, with potential secondary risks including malware distribution or further social engineering attacks. Analysis indicates the domain was registered on January 30, 2026, through Cloudflare, Inc., and currently resolves to IP address 188.114.97.3, hosted on AS13335. It is flagged by 4 out of 95 security vendors on VirusTotal, and appears on 3 distinct security blocklists. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the malicious intent, as the site remains active and unremediated. The page title, '$WAR - War on USD | Trade War Token | Join the Resistance,' directly mimics legitimate cryptocurrency project branding to enhance credibility. Users who visited this domain should immediately disconnect any connected wallets and revoke permissions via a blockchain explorer. Scan local devices for malware using updated security tools, focusing on browser extensions or downloaded files. Monitor financial accounts and wallet addresses for unauthorized transactions, and report the incident to relevant fraud authorities. Avoid interacting with any links or prompts from the site, and verify cryptocurrency projects only through official, verified channels.