usor-token[.]xyz

Analysis of usor-token.xyz shows the domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and immediately pointed to Cloudflare’s network (ASN 13335) with the IP address 172.67.203.87 located in the United States. The authoritative nameservers courtney.ns.cloudflare.com and ezra.ns.cloudflare.com confirm that the site leveraged Cloudflare’s CDN and HTTP/3 transport. An SSL certificate issued by Google Trust Services under the WE1 brand was observed, indicating a valid TLS handshake despite the malicious content. The page title retrieved from the live capture reads “U S Oil ($USO) – Tokenising Real World Oil using Ledger Blockchain”, which aligns with the declared crypto‑scam classification and suggests an attempt to lure investors interested in tokenised oil assets. VirusTotal scans returned five positive detections out of ninety‑five submitted engines, and the domain is listed on one public security blocklist.

Independent phishing‑filtering service PhishDestroy has also marked the site as blocked. The site’s current HTTP status is offline, which limits real‑time verification but does not remove the risk of re‑activation. No additional threat‑intel feeds (e.g., OTX, Safe Browsing) were supplied, leaving the broader campaign context uncertain. Defenders should add the domain, its IP address, and associated Cloudflare nameservers to outbound‑allow or DNS‑sinkhole policies.

Monitoring for new subdomains under the same registrar or similar naming patterns (e.g., “*token.xyz”) is advisable. Because the TLS certificate is legitimate, certificate‑pinning alone will not suffice; correlation with the observed page title and the five VirusTotal flags provides a reliable indicator set. Continuous re‑scanning of the domain is recommended to capture any future re‑hosting attempts. Organizations that manage or monitor US Oil‑related communications should treat any inbound traffic from this domain as malicious and block it at the perimeter.