Is earthmetaai.info a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

EarthMeta is a recently launched website whose homepage is titled "EarthMeta · The deed layer of the parallel earth". It positions itself as a digital layer of ownership or deed records for a virtual, "parallel" Earth, apparently as a web-based digital-asset or metaverse-style property concept. It presents a single, script-heavy landing experience, and the evidence does not show a named operating company behind it.

Scam/Impersonation Risk

Contradictory signals are present and material. Several major security vendors currently flag the domain as malicious. The reputation evidence is corroborated across sources and meets the threshold for a confirmed blacklist listing, which is decisive for this assessment. No brand impersonation and no conflicting legal identities were observed, so the risk rests on the external threat listing itself. The domain was also registered only weeks before analysis and has almost no independent history, which is the profile of a disposable or short-lifecycle property. Its concept, a "deed layer" for a parallel Earth, invites users to treat digital claims as ownership assets. That is a pattern commonly used to solicit payments or wallet interactions, although no such mechanism was captured here. In the browser sandbox the homepage showed none of the following: wallet-connection prompts, wallet-drainer behaviour, clipboard tampering, hidden forms, credential forms posting to outside parties, or content cloaking. It did generate a large volume of outbound third-party requests, including requests to destinations outside the recognised-service set. It also produced a very high number of script errors and large DOM mutations after interaction. That points to an unstable or heavily scripted page that makes many outside calls, and it does not offset the threat listing. Evidence:

• Domain registered 2026-08-24 (~0.17 years old), through the registrar Dynadot Inc, with registration running to 2027-08-24.
• Web archive shows 1 snapshot, first and last seen 2026-08-31 (1 year tracked), so there is no meaningful prior history.
• Homepage sandbox runs recorded 38 external XHR calls and 22 external POST requests, 12 of them to non-whitelisted destinations, plus 304 console errors.
• Homepage sandbox runs recorded no wallet-connect, drainer, clipboard-write, hidden-form or cloaking activity.

Regulatory Verification Notes

No regulatory registration or authorisation could be associated with this site, and no third-party broker-reputation record matched it. The real-world operator has not been independently connected to any named company or individual. Registration details are incomplete, which is an administrative ownership opacity and not an identity contradiction. Given the deed and ownership framing of the homepage, the absence of any identifiable accountable entity is significant for anyone considering a financial interaction. It is a verification gap, not proof of wrongdoing, but here it adds to a picture already driven by the external threat listing. Evidence:

• Served from AS13335 (Cloudflare, Inc., US), with the origin server not observable.
• TLS certificate issued by WE1 (DV, domain validation only), valid to 2027-01-20, with 86 days remaining at analysis. DV confirms control of the domain, not the identity of the operator.
• Homepage title presents an ownership or "deed" product concept, and the evidence names no issuing or operating legal entity.

What to Verify Next

Before any engagement, the operator's legal identity should be established through an independent route. That means requesting the registered company name and jurisdiction, then confirming them in the relevant public company registry. If the site claims any deed, asset, token or registry function, the supporting licence or authorisation should be confirmed directly with the named regulator. Official contact channels should be confirmed through an offline or independently sourced route. Any claim of ownership records or asset backing should be traced to an auditable, verifiable source before value is committed. Any prompt to connect a wallet, sign a transaction or send funds should be treated as unvetted until the threat listing is resolved. Evidence:

• The homepage's "deed layer" claim is unsupported in the evidence by any named registry, issuer or custodian.
• The site's heavy outbound third-party requests, including to non-whitelisted destinations, have no disclosed purpose.
• No independent corroboration of the project was found beyond the site itself.

Summary Verdict

The overall posture is high-risk. A confirmed external threat listing on a very new, unverified domain outweighs every neutral or positive technical attribute. The site's valid encryption and stable page loading show only that it is operational, not that it is safe or legitimate. Its real-world operator remains unverified.

Infrastructure Integrity

The site is fronted by Cloudflare's CDN and WAF. All observed addresses are CDN edge servers, and the origin host could not be observed. This is mitigating only, because it reflects a mainstream provider and a valid certificate. It also prevents independent verification of the true hosting and can mask rapid content changes. Protective infrastructure cannot offset the reputation risk established by the external detections.

Closing Assessment

The site should be limited to read-only viewing at most. Account creation, login, credential entry, wallet connection and any financial or asset transaction should be avoided, and nothing should be downloaded from it. Reassessment is appropriate only if the threat listing is cleared and an accountable operator is verifiably identified.