waronsol[.]ltd

The domain waronsol.ltd was registered on February 27, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the IP address 104.21.20.185, which is hosted by Cloudflare, Inc. (AS13335) and geolocated to the United States. The authoritative nameservers are kay.ns.cloudflare.com and trey.ns.cloudflare.com, confirming the use of Cloudflare's DNS infrastructure. No SSL certificate is presented for the site, indicating that HTTPS is not configured. The page title retrieved during analysis is "Just a moment...", and no further content analysis is available.

The domain is currently marked offline, and its risk level is classified as elevated. Detection intelligence shows that three security vendors on VirusTotal flagged the domain out of a total of 94 scanners, and the domain appears on three external blocklists. Specific blocklist entries include PhishDestroy, MetaMask, and SEAL, each of which has taken action to block the domain. The observed scam type is identified as a crypto scam, aligning with the generic phishing classification.

While the limited visible surface suggests a placeholder page, the combination of recent registration, Cloudflare hosting, lack of TLS, and multiple vendor detections indicates a purposeful malicious infrastructure. Defenders should continue to block the domain at network perimeter and endpoint layers, add the associated IP address to reputation filters, and monitor for any reactivation attempts. Ongoing surveillance of the hosting provider and related subdomains is advisable, as threat actors frequently rotate assets within Cloudflare's network. The absence of a valid SSL certificate and the presence on known blocklists provide sufficient evidence for immediate mitigation without requiring further content inspection.