uscr-gov[.]app

The domain uscr-gov.app was registered on February 21 2026 through NiceNIC International Group Co., Limited and is presently taken offline. DNS resolution points to the Cloudflare‑owned address 104.21.82.116, hosted on AS13335 in the United States. The authoritative nameservers are desiree.ns.cloudflare.com and paul.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. An SSL certificate issued by Google Trust Services (WE1) secures the site, and an HTTP 403 response is observed, indicating that direct content retrieval is blocked at the server level.

Threat intelligence classifies the site as a wallet/seed phishing operation that impersonates the United States Crypto Reserve, as reflected in the page title "USCR - United States Crypto Reserve." The domain appears on four security blocklists and is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL, demonstrating that multiple anti‑phishing services have identified it as malicious. VirusTotal scans show that seven of ninety‑three antivirus engines flag the domain, while the Gridinsoft trust score is 0 / 100, reinforcing the low trust assessment.

Observed indicators—registration date, Cloudflare hosting, Google‑issued TLS certificate, 403 status, low trust score, and multi‑vendor detection—provide a concrete fingerprint for detection and mitigation. However, the exact content of the hosted page has not been captured, and the specific phishing workflow (e.g., form fields, payload delivery) remains unknown due to the offline status and HTTP 403 response. Defenders should block the domain at DNS and proxy layers, add the IP address 104.21.82.116 to deny lists, and monitor for any future re‑hosting attempts under the same registrar or nameserver pattern. Continuous re‑scanning with VirusTotal and inclusion in threat‑intel feeds will help capture any changes to the site’s behavior or hosting infrastructure.