warcoins[.]lat

Analysis of warcoins.lat indicates that the domain was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare infrastructure (AS13335, United States) under the IP address 172.67.209.235. The site presented the page title “Un instant…”, did not serve an SSL certificate, and has since been taken offline. Threat intelligence sources have classified the domain as a generic phishing campaign. It is listed on three independent security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal records show that two of ninety‑three scanning engines flagged the domain, reinforcing the suspicion of malicious intent. The authoritative name servers are liv.ns.cloudflare.com and michael.ns.cloudflare.com, consistent with the Cloudflare hosting. Defenders should continue to deny any outbound connections to the observed IP address, enforce DNS‑level blocking of the fully qualified domain, and monitor for any resurgence of the domain or associated sub‑domains.

Given the recent creation date and the lack of a valid TLS certificate, the infrastructure appears to have been provisioned specifically for a short‑lived phishing operation. Ongoing vigilance is recommended, including periodic re‑query of VirusTotal and blocklist feeds to capture any new detections. No further content was captured, and the site is currently offline, reducing immediate risk but not eliminating the possibility of re‑use of the same infrastructure.