waronsol[.]live

waronsol.live was registered on 26 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolves to 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) and is hosted in the United States. DNS records list the authoritative nameservers dimitris.ns.cloudflare.com and khloe.ns.cloudflare.com. No TLS certificate is presented, indicating the site is served over plain HTTP.

The only visible HTTP response is a page whose title reads “Just a moment…”, a typical Cloudflare challenge page, and no further content has been captured. Threat intelligence flags the domain as a crypto‑related phishing campaign. It appears on three public security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. A VirusTotal scan involving 93 anti‑malware engines returned no detections, but the absence of flags does not constitute a safety guarantee.

The domain’s current status is offline, and no additional indicators such as malicious payload hashes, command‑and‑control endpoints, or credential‑stealing forms have been observed. Uncertainty remains regarding the exact phishing landing page, the targeted cryptocurrency wallets, and whether the infrastructure has been reused for other campaigns. Analysts should continue to monitor DNS resolution for any reactivation, enforce network‑level blocks for the IP 188.114.96.3 and the domain itself, and consider adding the domain to internal blocklists. If the site reappears, traffic inspection should focus on attempts to capture wallet credentials or trigger transactions, and any observed payloads should be submitted to malware sandboxes for further analysis.