eigenplayer[.]xyz

This domain represents a high-risk brand impersonation threat specifically targeting EigenLayer, a decentralized trust protocol. The site mimics the official EigenLayer interface under the page title 'Eigenlayer App,' attempting to deceive users into submitting sensitive credentials or wallet interactions. Analysis indicates the domain was designed to harvest authentication details or manipulate victims into authorizing malicious smart contracts, a common tactic in cryptocurrency-related phishing operations. Infrastructure analysis reveals multiple indicators of malicious intent. The domain eigenplayer.xyz was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with fraudulent registrations. It resolves to IP address 172.67.192.191 and employs Cloudflare with HTTP/3, a configuration often used to obfuscate hosting origins. The domain appears on 5 security blocklists and is flagged by 13 out of 95 security vendors on VirusTotal. Additionally, it holds a Gridinsoft trust score of 0/100, further confirming its classification as malicious. Users who visited eigenplayer.xyz should immediately revoke any active wallet authorizations associated with the domain. All credentials entered should be considered compromised and changed across all platforms where identical or similar passwords were used. Wallet software should be scanned for unauthorized transactions or contract approvals. If cryptocurrency transactions were initiated, victims should document all transaction hashes and report the incident to relevant blockchain analytics platforms and local cybercrime authorities. No further interaction with the domain is advised, and users should verify all future communications through official EigenLayer channels only.