whitelist-usor[.]com

The domain whitelist-usor.com has been identified as a brand impersonation threat specifically targeting the Ledger cryptocurrency hardware wallet brand. This domain is currently offline, but its malicious intent was confirmed through multiple security analyses before it was taken down. The site attempted to deceive users by presenting itself as a legitimate Ledger-related platform, with a page title referencing "U.S Oil ($USO) - Tokenising Real World Oil using Ledger Blockchain," which is a clear attempt to leverage Ledger's trusted name for fraudulent purposes.

Security intelligence reveals that whitelist-usor.com was flagged by 13 of 95 VirusTotal security vendors, indicating a strong consensus on its malicious nature. The domain was registered through NiceNIC International Group Co., Limited and created on February 21, 2026. It resolved to IP address 104.21.36.117 and appeared on three security blocklists. Additionally, AlienVault OTX recorded it in one threat intelligence pulse, and the SSL certificate was issued by Google Trust Services (WE1). These indicators collectively point to a sophisticated phishing operation designed to steal credentials or cryptocurrency assets from unsuspecting users.

As the domain is now offline, the immediate risk is reduced, but users should remain vigilant against similar threats. PhishDestroy recommends that anyone who may have interacted with whitelist-usor.com change their Ledger-related passwords and enable two-factor authentication immediately. It is also advisable to monitor accounts for any unauthorized activity and to report any suspicious domains to security teams. Always verify the authenticity of websites by checking official brand communications before entering sensitive information.