waronsol[.]life

Analysis of waronsol.life indicates that the domain was registered on 2026-03-03 and is currently offline. The authoritative name servers are linda.ns.cloudflare.com and sullivan.ns.cloudflare.com, pointing to a Cloudflare edge address 104.21.16.180 located in the United States and associated with AS13335. No TLS certificate was observed, meaning HTTPS connections would not be established under default configuration. An HTTP request returns the page title “Just a moment…”, which provides no further functional context.

The domain is listed on three public blocklists and is specifically flagged by PhishDestroy, MetaMask, and SEAL, consistent with its classification as a crypto‑related phishing effort. VirusTotal reports indicate that the domain has been scanned by 93 anti‑malware engines, none of which raised a detection at the time of scanning; this absence of alerts does not imply safety, only that known signatures have not yet identified malicious payloads. The combination of recent registration, lack of encryption, presence on multiple blocklists, and the explicit “Crypto Scam” tag suggests deliberate use for fraudulent cryptocurrency activity. However, because the site is offline, no live payload or credential‑capture page can be verified, leaving the exact phishing vector uncertain.

Defenders should continue to block the domain at perimeter filters, monitor DNS traffic for queries to waronsol.life, and add the host to any internal blacklists. Additional scrutiny of outbound connections to the underlying Cloudflare IP is advised, as the address may serve other malicious domains. Ongoing observation of related blocklist updates and re‑scanning by sandbox services is recommended to detect any future reactivation.