shares-usor[.]app

This domain, shares-usor.app, is flagged as a brand impersonation threat specifically targeting Ledger, a cryptocurrency hardware wallet provider. Analysis of the page title reveals a fraudulent scheme promoting 'U.S Oil ($USO) - Tokenising Real World Oil using Ledger Blockchain,' which attempts to lure victims into interacting with a fake tokenization platform. The domain appears designed to harvest credentials or distribute malicious payloads under the guise of legitimate blockchain services, though no specific drainer kit signatures have been confirmed in initial analysis. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to IP address 188.114.96.3. It is currently detected by 9 out of 95 security vendors on VirusTotal, with only 1 appearance on security blocklists. The domain employs SSL certification from Google Trust Services and utilizes Cloudflare for hosting, including HTTP/3 and HSTS technologies. Despite these security measures, the domain has been categorized with a Gridinsoft trust score of 0/100, indicating a high level of malicious activity. As of the latest assessment, shares-usor.app has been taken offline, reducing immediate risk to end users. The domain was blocked by PhishDestroy, and no active connections are currently resolving. However, remaining risk persists due to the potential reuse of associated infrastructure or registration of similar domains by the same threat actor. Users are advised to verify all blockchain-related communications through official Ledger channels and monitor for unauthorized transactions. Security teams should add the domain and its resolving IP to internal blocklists for proactive defense.