events-usor[.]xyz

events-usor.xyz is currently offline but its infrastructure indicates a deliberate brand‑impersonation campaign targeting the Across brand. The domain was registered on 21 February 2026 through Eranet International Limited and uses Cloudflare’s DNS service (david.ns.cloudflare.com, naya.ns.cloudflare.com). DNS resolution points to IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. No TLS certificate is presented, meaning the site would have been served over plain HTTP if it were active. The page title observed during the brief crawl was “U.S Oil | Airdrop”, and the underlying phishing kit has been identified as an “Airdrop Scam” commonly used for wallet or seed harvesting.

The campaign’s intent aligns with wallet/seed phishing, where victims are prompted to submit cryptocurrency wallet seeds or private keys. Threat‑intel feeds have already flagged the domain. It appears on two dedicated blocklists – PhishDestroy and ScamSniffer – and VirusTotal’s multi‑engine scan recorded four detections out of ninety‑three scanners. The lack of an SSL certificate and the use of a generic “U.S Oil | Airdrop” title suggest an attempt to lure users seeking cryptocurrency airdrops, a known vector for extracting private keys.

The domain’s short lifespan (registered less than five months ago) and immediate inclusion on blocklists indicate an opportunistic deployment. Uncertainty remains regarding the exact content of the landing page and any additional malicious payloads, as the site is presently taken offline and no further HTTP response data is available. Defenders should add the domain and its resolved IP address to deny‑list rules, monitor for any future resolution to the same IP or similar Cloudflare‑hosted nameservers, and continue to reference the identified phishing kit signature for detection. Ongoing observation of the associated blocklists and VirusTotal updates is recommended to capture any re‑activation attempts.