usor[.]tech

Analysis indicates the domain usor.tech is actively engaged in a cryptocurrency scam impersonating Ledger, a hardware wallet provider. The domain was registered on February 21, 2026, and currently resolves to 188.114.97.3, an IP address assigned to AS13335 (Cloudflare, Inc.). Infrastructure analysis reveals the use of Cloudflare nameservers (wally.ns.cloudflare.com, maxim.ns.cloudflare.com) and hosting via Vercel, with HTTP/3 and HSTS enabled. The page title, 'U.S Oil ($USO) - Tokenising Real World Oil using Ledger Blockchain,' explicitly references Ledger and promotes a fraudulent tokenization scheme, aligning with the reported scam type of cryptocurrency fraud. The domain holds a Gridinsoft trust score of 1/100, appears on one security blocklist, and is flagged by PhishDestroy. Three of 95 security vendors on VirusTotal have detected this domain as malicious. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites. While the domain remains active as of July 12, 2026, no additional technical artifacts—such as phishing kits, redirect chains, or backend infrastructure—have been confirmed in the available data. Defenders should treat usor.tech as a high-risk domain due to its brand impersonation, low trust scores, and association with cryptocurrency fraud. Recommended actions include blocking the domain at the DNS or proxy level, monitoring for related subdomains or IPs, and alerting users to the specific threat of Ledger-branded token scams. Further investigation into the backend infrastructure and any associated wallet addresses is advised to disrupt the campaign.