eligibility-xdc[.]network

Analysis of the domain eligibility-xdc.network confirms its classification as an active phishing site targeting users of the XDC Network. Registered on July 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to the IP address 104.21.59.198, which is associated with Cloudflare infrastructure, as indicated by its nameservers (adam.ns.cloudflare.com and danica.ns.cloudflare.com). This hosting pattern is consistent with threat actors leveraging Cloudflare’s services to obscure the origin of malicious traffic and evade takedown efforts. As of July 26, 2026, the domain remains active and has been flagged by at least one security blocklist.

VirusTotal telemetry indicates that 3 out of 91 security vendors have detected the domain as malicious, though the specific nature of these detections—whether related to phishing, malware distribution, or other abuse—has not been disclosed. The domain’s registration age (five days at the time of analysis) aligns with typical phishing campaign lifecycles, where newly registered domains are frequently weaponized before being abandoned or suspended. The naming convention of the domain (eligibility-xdc.network) strongly suggests an intent to deceive users by impersonating the XDC Network, a blockchain platform. While the exact content of the site has not been analyzed, the combination of the domain name, recent registration, and detection by security vendors supports its classification as a credential phishing operation.

Defenders are advised to treat this domain as high-risk and implement blocking measures at the DNS or network level. Organizations utilizing XDC Network should alert users to the presence of this phishing domain and monitor for related indicators of compromise. Further investigation into the IP address 104.21.59.198 may reveal additional associated malicious domains, though Cloudflare’s shared hosting environment may limit the specificity of such findings.