waronusd1[.]run

waronusd1.run is a phishing domain engaged in brand impersonation targeting the WarOnUSD1 brand. It poses an elevated risk by attempting to deceive users into believing they are interacting with the legitimate brand. The domain has been taken offline, mitigating immediate risk but highlighting the importance of awareness around such scams. Users searching if waronusd1.run is safe should understand it is a scam designed to impersonate WarOnUSD1 and should be treated with caution.

Technical indicators for waronusd1.run include detection by 1 of 95 VirusTotal security vendors and presence on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. The domain was created on March 09, 2026, at 13:07:02, registered through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to IP address 188.114.97.3, located in the US under AS13335 Cloudflare, Inc., and uses an SSL certificate issued by Let’s Encrypt / E7. Technologies detected on the domain included Cloudflare Browser Insights, Cloudflare, and HTTP/3. The page title observed was 'Just a moment...'. Nameservers used were maya.ns.cloudflare.com and amos.ns.cloudflare.com.

To stay safe from waronusd1.run phishing attempts, users should change passwords if they have entered credentials, enable two-factor authentication where possible, and monitor accounts for suspicious activity. Since this is a brand impersonation scam without a crypto drainer kit, revoking token approvals is not applicable. Users are encouraged to report suspicious domains like waronusd1.run to relevant security blocklists and to their email or service providers to help prevent further phishing attacks.