waronusd1-vote[.]com

PhishDestroy identifies waronusd1-vote.com as an active brand impersonation domain targeting WarOnUSD1, likely designed for credential theft or crypto drainer deployment. The domain was registered on March 27, 2026, and is hosted on IP 104.21.89.50, with a Let's Encrypt SSL certificate. No drainer kit artifacts (e.g., MetaMask or WalletConnect scripts) are publicly visible yet, but the threat actor’s goal appears to be deception via visual mimicry of WarOnUSD1’s branding and infrastructure.

This domain exhibits several suspicious technical indicators. VirusTotal currently shows 2/95 detections, indicating it remains undetected by most antivirus engines as of April 2026. The domain is registered through Metaregistrar BV, a registrar not inherently malicious but frequently observed in bulk-registered impersonation campaigns. The domain resolves to Cloudflare IP 104.21.89.50, which hosts multiple low-reputation sites. Google Safe Browsing (GSB) has not yet flagged this domain, and it does not appear on public blocklists such as PhishTank or OpenPhish at this time.

As of this report, waronusd1-vote.com remains active and under investigation. Immediate actions include blocking the domain at DNS and network levels, flagging it in threat intelligence platforms, and advising users to avoid interaction. The risk remains high due to the absence of detection and the active nature of the domain, suggesting potential escalation into a live credential theft or crypto drainer campaign. Users should treat any communications referencing WarOnUSD1 with extreme caution and verify destination URLs directly from official channels.