allocation-usor[.]com

Analysis of allocation-usor.com indicates a high-risk crypto-scam operation impersonating Ledger, a cryptocurrency hardware wallet provider. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and remains active as of July 23, 2026. Infrastructure analysis reveals Cloudflare hosting (AS13335) with nameservers alfred.ns.cloudflare.com and raina.ns.cloudflare.com, resolving to IP 104.21.96.142 in the United States. The site returns an HTTP 301 redirect, suggesting it may forward visitors to another malicious endpoint, though the final destination is not yet confirmed in available data.

The page title, 'U.S Oil ($USO) - Tokenising Real World Oil using Ledger Blockchain,' explicitly references Ledger’s brand in a likely fraudulent scheme involving tokenized assets. This aligns with the scam type classification as a crypto scam, a determination supported by detection from 6 of 91 security vendors on VirusTotal and listings on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The domain holds a Gridinsoft trust score of 0/100, further indicating malicious intent. SSL certification is provided by Google Trust Services (WE1), a common practice among threat actors to lend superficial legitimacy.

Defenders should treat this domain as confirmed malicious infrastructure. The combination of brand impersonation, low trust scores, blocklist presence, and explicit crypto-scam classification provides sufficient evidence for immediate blocking. While the exact mechanics of the scam—such as whether it involves wallet drainers, fake token sales, or phishing for recovery phrases—remain unconfirmed due to lack of deeper behavioral analysis, the observable indicators strongly support its designation as an active threat. Network-level protections should prioritize this domain alongside other Ledger-themed scam infrastructure.