whitelist-usor[.]app

The domain whitelist-usor.app has been identified as an elevated-risk brand impersonation threat specifically targeting the Ledger brand. This type of attack attempts to deceive users into believing they are interacting with a legitimate Ledger service, often to steal sensitive information or cryptocurrency. The page title, 'U.S Oil ($USO) - Tokenising Real World Oil using Ledger Blockchain', is a clear attempt to leverage the Ledger name to lend credibility to a fraudulent scheme. Although the domain is currently offline, users should remain vigilant as similar domains may appear.

Technical analysis reveals several red flags. VirusTotal flagged the domain with 9 out of 95 security vendors marking it as malicious. The domain was registered through NiceNIC International Group Co., Limited, a registrar often associated with suspicious domains, and was created on February 21, 2026. It resolves to IP address 104.21.22.108 and uses an SSL certificate from Google Trust Services (WE1). The domain appears on 3 security blocklists, and trust scores are low due to these indicators. All these data points point to a well-structured phishing operation designed to exploit the Ledger brand.

Users who may have encountered whitelist-usor.app should take immediate action. Since the threat is brand impersonation, anyone who entered credentials or private keys on the site should assume they are compromised and transfer funds to a new wallet immediately. Enable two-factor authentication on all accounts and monitor for unauthorized transactions. Report any suspicious activity to Ledger's official support channels. Avoid clicking on links from unsolicited emails or messages claiming to be from Ledger, and always verify URLs before entering sensitive information.