waronsoi[.]pro

This domain, waronsoi.pro, is actively engaged in a cryptocurrency airdrop scam as of July 12, 2026. Analysis indicates the site impersonates legitimate token distribution events under the page title 'WAR | AirDrop,' a common tactic in fraudulent crypto reward schemes. The domain was registered on March 3, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolves to IP address 104.21.40.169, hosted on Cloudflare's network (AS13335) in the United States, which provides both performance and anonymity benefits to threat actors. Detection metrics show the domain is flagged by five out of ninety-five security vendors on VirusTotal, while appearing on three distinct security blocklists. Protective measures have been implemented by multiple entities, including browser-based and wallet-level blocking mechanisms. The site employs modern web technologies such as Node.js, Vue.js, and Nuxt.js, alongside Cloudflare's infrastructure, which may complicate traditional takedown efforts. SSL certification is provided by Let's Encrypt, further lending an appearance of legitimacy to unsuspecting users. The operational status of waronsoi.pro remains active, with an HTTP 200 response code indicating full functionality. While the specific phishing kit in use is identified as an airdrop scam variant, the exact distribution methods and target audience remain unclear. Defenders should prioritize blocking the domain at DNS and network levels, as well as monitoring for associated indicators of compromise. Given the domain's presence on multiple blocklists and its use of Cloudflare, additional scrutiny of related infrastructure—including nameservers ariadne.ns.cloudflare.com and ignacio.ns.cloudflare.com—is recommended to identify potential pivot points for further malicious activity.