waronsoi[.]xyz

The domain waronsoi.xyz was registered on 2026-03-03 through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to the Cloudflare address 172.67.215.128, which belongs to ASN 13335 (Cloudflare, Inc.) located in the United States. DNS resolution uses the Cloudflare authoritative nameservers dolly.ns.cloudflare.com and nick.ns.cloudflare.com. The site presented a page titled “Just a moment...” before being taken offline, and no TLS certificate was observed for the host, indicating that HTTPS was not enforced at the time of capture. Gridinsoft assigned a trust score of 0 out of 100, reflecting a lack of confidence in the domain’s legitimacy.

VirusTotal analysis recorded detections from 2 of 93 security vendors, confirming that at least a minority of scanning engines flagged the site as malicious. The domain is listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing‑related resource. The combination of a recent registration date, use of Cloudflare’s edge network, absence of a valid certificate, low trust score, and multiple blocklist entries suggests a deliberately short‑lived malicious infrastructure.

Uncertainty remains regarding the specific payload or credential‑stealing technique employed, as the page content beyond the title has not been disclosed. Defenders should add waronsoi.xyz to URL filtering rules, monitor DNS queries for the associated Cloudflare IP range, and ensure that endpoint protection solutions are updated to include the two vendor detections reported by VirusTotal. Continuous observation of the registrar and any future re‑registration attempts is advisable, as threat actors often recycle Cloudflare‑fronted domains after takedown.