warsonusd1[.]xyz

This domain is flagged as a brand‑impersonation campaign targeting the WarOnUSD1 brand. The zone warsonusd1.xyz was registered on 2026‑03‑03 through NiceNIC International Group Co., Limited and is currently offline. Authority records show the domain was delegated to ara.ns.cloudflare.com and burt.ns.cloudflare.com, indicating that the hosting infrastructure is provided by Cloudflare, Inc. The A record resolves to 172.67.173.108, an address belonging to AS13335 (Cloudflare) located in the United States. No TLS certificate was observed, meaning the site did not serve HTTPS content during the investigation. The HTTP response delivered a page with the title “Just a moment…”, which provides no functional insight into the payload.

VirusTotal analysis recorded four positive detections out of ninety‑four scanned engines, confirming malicious behavior. Independent reputation services assigned a Gridinsoft trust score of 0 out of 100, and the domain appears on three security blocklists. Additional protection products, including PhishDestroy, MetaMask, and SEAL, have listed the domain as blocked. The collective evidence aligns with the elevated risk rating assigned to the campaign.

Defenders should add the domain to outbound‑traffic deny lists and ensure that DNS resolvers block queries for warsonusd1.xyz. Monitoring for future re‑registration of the same name or similar namespaces is advisable, as the infrastructure (Cloudflare nameservers and IP range) is readily reusable. Integrating the observed indicators—registration date, registrar, IP address, nameserver set, and the “Just a moment…” page title—into threat‑intelligence platforms will improve detection of any resurgence. Continuous review of threat‑feed updates for new detections related to the WarOnUSD1 brand is recommended.