war-usd1[.]com

Analysis of war-usd1.com, observed as a brand‑impersonation site targeting the WarOnUSD1 project, indicates that the domain was registered on 22 February 2026 through NiceNIC International Group Co., Limited. The authoritative name servers are lamar.ns.cloudflare.com and sky.ns.cloudflare.com, pointing the domain to the Cloudflare edge address 172.67.210.10, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. No TLS certificate is presented, and the site currently returns no HTTP response because it has been taken offline. The HTML title retrieved before takedown reads “$WAR – War on USD | Trade War Token | Join the Resistance”, which aligns with the declared intent to impersonate the WarOnUSD1 brand.

The domain appears on three independent security blocklists and has been flagged by the PhishDestroy, MetaMask, and SEAL blocklist providers. VirusTotal scans show two of ninety‑five antivirus engines reporting malicious activity, reinforcing the suspicion of abuse. The combination of recent registration, use of a reputable CDN service, lack of encryption, and presence on multiple blocklists suggests a deliberate attempt to lure users interested in the WarOnUSD1 token ecosystem.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no sample page content beyond the title has been captured. Defenders should add war‑usd1.com to internal block and sink‑hole lists, monitor Cloudflare‑origin IP 172.67.210.10 for related activity, and advise users of WarOnUSD1 to disregard any unsolicited communications referencing $WAR or “Join the Resistance”. Ongoing vigilance is recommended until the domain remains offline and any associated infrastructure is fully remediated.