eigenlayer-checker[.]web[.]app

This domain is flagged as a high-risk brand impersonation threat targeting EigenLayer users. Analysis indicates the site operates under the guise of an airdrop verification tool, a common tactic to harvest wallet credentials or private keys from unsuspecting cryptocurrency holders. The specific threat involves credential theft through deceptive input forms, likely designed to mimic legitimate EigenLayer interfaces. Infrastructure analysis reveals the following technical indicators: the domain eigenlayer-checker.web.app was registered through Google LLC on April 10, 2026, and resolves to the IP address 199.36.158.100, hosted within the United States under Google LLC infrastructure. The SSL certificate is issued by Google Trust Services (WR4). Detection engines report 1 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by at least three independent threat intelligence feeds. The page title explicitly reads 'EigenLayer Airdrop Checker,' reinforcing its fraudulent intent. To mitigate risks associated with this threat, users should avoid interacting with the domain entirely. If credentials were already entered, immediate steps include revoking any connected wallet permissions, transferring assets to a new secure wallet, and monitoring for unauthorized transactions. Network-level protections should be updated to include the domain and its resolving IP (199.36.158.100) in blocklists. Organizations should alert users to the presence of such scams and reinforce verification practices, such as cross-referencing official EigenLayer communication channels before engaging with airdrop-related sites.