eligible-usor[.]xyz

The domain eligible-usor.xyz is a confirmed cryptocurrency phishing site posing a generic phishing threat. It does not impersonate a specific brand but presents itself as a fraudulent 'USOR Project | AirDrop' scheme designed to deceive users into disclosing wallet credentials or transferring cryptocurrency. As of the latest verification, eligible-usor.xyz has been taken offline, though prior activity classified it as an elevated-risk scam.

Technical indicators confirm the malicious nature of eligible-usor.xyz. The domain was flagged by 3 of 95 security vendors on VirusTotal, including alphaMountain.ai, Forcepoint ThreatSeeker, and SOCRadar. It appears on three security blocklists: PhishDestroy, MetaMask, and SEAL. Registered through Eranet International Limited on February 21, 2026, the domain resolves to the IP address 188.114.96.3, hosted by Cloudflare, Inc. (AS13335) in the US. No SSL certificate was issued, and the nameservers are autumn.ns.cloudflare.com and west.ns.cloudflare.com. Google Safe Browsing did not flag the domain at the time of assessment.

Users who interacted with eligible-usor.xyz should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new, secure wallet. Monitor transaction histories for unauthorized activity and report the domain to relevant platforms, such as the Anti-Phishing Working Group (APWG) or the Federal Trade Commission (FTC). If credentials were entered, consider them compromised and avoid reusing them across other services.