waronusd-alled[.]pages[.]dev

PhishDestroy identifies waronusd-alled.pages.dev as an active brand impersonation domain targeting WarOnUSD1 users. Registered through Cloudflare’s Pages service, the domain leverages a legitimate-looking subdomain under pages.dev to deceive visitors into believing it is an official WarOnUSD1 site. No publicly documented drainer kit association has been recorded, but the domain’s sole purpose is to harvest credentials or cryptocurrency under the guise of a trusted brand. This aligns with the growing trend of “drainer-as-a-service” impersonation campaigns targeting digital asset holders via lookalike domains hosted on reputable cloud platforms.

Technical analysis confirms waronusd-alled.pages.dev resolves to IP 188.114.97.3, secured with a Let's Encrypt SSL certificate (common among phishing sites to appear legitimate). The domain was checked on VirusTotal and currently shows 0 detections out of 95 scanners, indicating it remains undetected by most antivirus engines at time of analysis. The registrar is Cloudflare, Inc., and the domain uses Cloudflare Pages for hosting—both platforms frequently abused in time-sensitive phishing campaigns due to fast provisioning and free tiers. No Google Safe Browsing (GSB) classification or third-party blocklist entries were detected in public feeds as of the last scan.

As of this report, the threat remains active and is under continuous monitoring by PhishDestroy. Immediate defensive actions include blocking the IP 188.114.97.3 and domain waronusd-alled.pages.dev at network and endpoint levels. Users are strongly advised to verify all URLs against official WarOnUSD1 domains and enable multi-factor authentication. Remaining risk is assessed as moderate due to low detection rates and cloud-hosted evasion tactics. Vigilant threat intelligence sharing is required to prevent further dissemination of this scam across user communities. The domain seed hash b3fc71 ensures consistent tracking across detection systems.