Is efilaunch.live a scam? TrustSniffer's high-risk assessment: 1/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website presents a single landing page titled "ether.fi — Claim $EFI" on the domain efilaunch.live. It invites visitors to claim a token called $EFI, a token-claim or airdrop-style proposition framed around the ether.fi name. The page carries only a short block of text, and no operator, product documentation or corporate details could be tied to it. Its apparent purpose is to draw visitors into a crypto-asset claim flow under a third-party brand, but that association is unconfirmed.

Scam/Impersonation Risk

This site carries an elevated, evidence-backed risk and is blacklisted. Several leading security vendors currently flag it as malicious, and an external blacklist listing is confirmed. That is a decisive contradiction. The domain is a newly created, standalone address, yet its page title borrows an established DeFi brand name and offers a token "claim". This is the classic structure of a claim-lure or brand-adjacent campaign. The evidence does not establish that the brand owner is connected to the site, and no conflicting legal identities appear. The brand framing therefore counts as an unverified association claim that, together with the blacklisting, raises the exposure for anyone who might connect a wallet or sign a transaction. A large body of abuse reports exists for the shared provider address the site resolves to. Those reports are attributed to the infrastructure provider's many tenants and are discounted, so they are not counted against this site. The sandbox runs found no external data posts, no wallet-connect or wallet-drainer behavior, no clipboard manipulation, no hidden forms and no cloaking. This is a mild mitigating observation, but it cannot offset the blacklisting, and high console-error volume and a low-depth page suggest a thin, hastily assembled build. Evidence:

• Homepage title reads "ether.fi — Claim $EFI", pairing an established brand name with a token-claim call to action on an unrelated domain.
• Domain registered in 2026 (~111 days old), consistent with a recently stood-up campaign domain.
• Web archive holds 1 snapshot, captured 2026-07-06 (1 year tracked), so there is no meaningful prior history for the domain.
• Homepage sandbox runs showed no external posts, wallet-drainer activity, clipboard writes or cloaking, but recorded repeated console errors.

Regulatory Verification Notes

The captured page does not identify an operating company, a registered address, a licensing authority or a responsible legal entity. The site also offers no accountable ownership or governance information, so ownership opacity applies. The operator's real-world identity could not be independently connected to any brand or person. Because a token-claim proposition implies handling value, the absence of any disclosure is material here. It is not proof of wrongdoing in itself, but it removes any means of recourse. No regulatory registration was found, and no broker-reputation record matched. The site is not recognized as a known DeFi protocol. Technical hygiene is basic: the site has valid transport encryption, but only domain-validated, which proves control of the domain and says nothing about who operates it. Evidence:

• Homepage content names no company, licence or registry number.
• Served from AS16509 (AMAZON-02 - Amazon.com, Inc., US).
• TLS certificate issued by YR2 (DV), valid to 2026-12-03.
• Not recognized as a DeFi protocol in DeFiLlama, so no TVL or market footprint supports the claim proposition.

What to Verify Next

Anyone who encounters this site through a message, advertisement or social post should treat the offer as unverified. The claim should be checked only by independently navigating to the brand's officially published channels, such as its verified social accounts or documentation, and confirming whether any $EFI distribution exists. The domain should not be reached through the originating link. Any legitimacy claim should be tested against the brand's own announcements, not against this page. Official support and contact routes should be confirmed through those independent channels. Where a real obligation exists, an authorised registry or the brand's issuer should confirm any licence or operator details. Evidence:

• The homepage offers no verifiable operator identity or official-channel reference to test against.
• The domain is only about 111 days old, with a single archive capture, so no independent history can corroborate it.
• The page is presented as a one-page claim funnel, with no supporting documentation pages observed.

Summary Verdict

The overall posture is high risk. Confirmed adverse security-vendor detections and a blacklist listing, combined with a very young domain, an unverified brand association and an unidentified operator, converge on a site that cannot be regarded as trustworthy. Protective technical measures do not change this conclusion.

Infrastructure Integrity

The site is hosted on Amazon-operated address space behind a protective CDN/WAF layer, and every observed address is an edge address. The origin was not observable, so the hosting arrangement cannot be independently verified, and an edge-only view can mask rapid content changes behind a stable front. Valid encryption and mainstream infrastructure are treated purely as mitigating factors. They do not establish legitimacy and cannot offset the reputational findings.

Closing Assessment

The site should be treated as unsafe for any interaction involving login, credentials, wallet connection, signing or payment. At most, it may be viewed in a read-only manner, such as for analysis. Anyone who has already interacted with it should disconnect and review wallet approvals, rotate any exposed credentials, and report the page to the impersonated brand and the relevant security channels.

Signals weighed against the site

• AbuseIPDB: 267 reports on hosting IP 216.198.79.1 (Vercel, Inc, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.