Is evernorthlabs.info a scam? TrustSniffer's high-risk assessment: 3/100

Security Alert

Fortinet, Google, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page web portal titled "Evernorth Allocation Portal — Claim Your XRPL Treasury Tokens". It presents itself to visitors as a place to claim an allocation of XRPL-linked treasury tokens, and its apparent purpose is to draw visitors into a token-claim flow under the name of a corporate-style "Evernorth" brand. It runs on a recently registered .info domain.

Scam/Impersonation Risk

This assessment is cautionary and security-forward. Contradictory signals are present. Several independent threat-intelligence sources currently list the domain as malicious, and a major browser-safety list flags it for social engineering, so the site is confirmed as blacklisted. The lure on the homepage fits this pattern. It offers an unsolicited "claim" of treasury tokens under an institutional-sounding brand, and this kind of framing is commonly used to pull visitors into credential or wallet-related steps. The listing is decisive and nothing in the site's infrastructure offsets it. The real-world operator and the site's link to any genuine organisation called Evernorth remain unestablished, and the evidence does not support presuming a legitimate affiliation. Behavioural testing found no wallet-drainer, clipboard-hijack, hidden-form or cloaking activity, but this does not weaken the external listings. The homepage also sent three background submissions to non-whitelisted external destinations. Roughly seven in ten of its external data requests went to third-party endpoints, which is an unusually heavy outbound footprint for a single-page portal. Evidence:

• Homepage: the title and content present a token-allocation claim portal under the "Evernorth" name, with no verifiable tie to a real organisation.
• Threat intelligence: 12 engines rated the domain malicious and 2 suspicious. The browser-safety list flagged it under the social-engineering category, and the Google, Fortinet, Kaspersky and Sophos-class tier-one detections include major security vendors.
• Homepage behaviour: 3 external POST submissions went to non-whitelisted destinations, and 6 of the external requests observed went to non-whitelisted hosts.
• Domain provenance: registered 2026-07-06 (~0.3 years old), with 1 archive snapshot (first seen 2026-07-10, 1 year tracked), so there is no meaningful operating history.

Regulatory Verification Notes

No licence, registration number, regulator reference or named legal entity could be tied to the site. On-page disclosure of a legal operator is unclear, and ownership of the domain is opaque. This is an administrative limitation and not a contradiction in itself. It matters here because the site invites a financial-style action, namely claiming digital assets. It is not a verdict about any specific legal entity. The domain is registered through NICENIC International Group Co., Limited, a registrar commonly used for low-cost registrations that does not itself vouch for the registrant. No third-party broker or regulator listing was matched, so no reputational signal from that channel is available, positive or negative. The valid encryption certificate confirms only that the connection is encrypted and does not establish who runs the site. Evidence:

• Homepage: no legal-entity name, licence, registration number or regulator reference is presented alongside the claim offer.
• Registration record: registrar NICENIC International Group Co., Limited. The domain was created 2026-07-06 and expires 2027-07-06, a one-year term. Registrant details are hidden or incomplete.
• Transport security: TLS certificate issued by WE1 at domain-validation (DV) level, valid to 2026-12-02 (41 days remaining). DV validates domain control only, not the operator's identity.
• Hosting: served from AS13335 (Cloudflare, Inc., US).

What to Verify Next

Verification should start from the organisation the site claims to represent. It should not start from anything on the portal itself. Any allocation, airdrop or claim programme should be checked against that organisation's officially published channels, reached through independently sourced addresses and not through links or contacts on this site. If no such programme is announced there, the portal should be treated as unsupported. A search of the relevant financial or securities registry for a legal entity matching the brand can establish whether a real issuer exists. Anyone who has already interacted with the site should review wallet approvals and change any reused passwords. The domain should be reported to the browser-safety and registrar abuse channels. Evidence:

• Homepage: the claim offer under the "Evernorth" name is the item to confirm or refute with the named organisation.
• Homepage: no contact or governance information is offered that could serve as an independent verification route.
• Threat intelligence: the existing browser-safety and multi-engine listings mean any benign explanation would have to come from the operator through a formal review.

Summary Verdict

The site is assessed as high-risk and unsuitable for sensitive interaction. Current external threat detections, a very short operating history and the unverified identity of its operator all point the same way. Technical hygiene such as encryption and a stable response does not alter this conclusion.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every observed address is a Cloudflare edge address. The origin server is not exposed, and the site's hosting reputation is itself clean. This is a mitigating factor only. Edge-only visibility prevents independent verification of the true hosting location and can mask rapid content swaps. It cannot offset the threat listings.

Closing Assessment

Do not enter credentials, connect or sign with a wallet, make payments, or download anything from the site. At most, treat it as something to observe from a safe, isolated environment, and report it to the relevant abuse channels.