usor[.]app

Analysis of usor.app on 23 July 2026 shows a high‑risk brand‑impersonation campaign targeting Ledger users. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 172.67.150.183 (AS13335, United States). The SSL certificate is issued by Google Trust Services under the “WE1” designation, indicating a valid TLS configuration, while HSTS and HTTP/3 are enabled, reflecting modern web security settings typical of legitimate services but also used to increase credibility. Cloudflare’s DNS infrastructure is evident from the nameservers karl.ns.cloudflare.com and suzanne.ns.cloudflare.com. Threat intelligence flags the domain on three external blocklists and it is actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal reports that seven of ninety‑three scanning engines have generated detections, reinforcing the malicious classification. The Gridinsoft trust score of 0 out of 100 further demonstrates a lack of trustworthiness. The underlying payload aligns with a “Wallet Connect Abuse” kit, commonly employed to harvest cryptocurrency credentials, and the overall scam type is identified as a crypto scam. Defenders should treat any connection to usor.app as malicious. Network controls ought to block the IP 172.67.150.183 and the associated Cloudflare ASN 13335.

Endpoint security solutions should incorporate the domain into blocklists and watch for Wallet Connect traffic patterns. Because the site returns an HTTP 301 redirect, monitoring for follow‑up URLs is advisable. At present, no additional content has been publicly disclosed beyond the page title, so further forensic capture of the landing page would be valuable for confirming credential‑stealing forms or malicious scripts. Continuous re‑evaluation is recommended as the campaign remains active.