claim-evr[.]org

The domain claim-evr.org was registered on May 18, 2026 through the registrar Key-Systems GmbH. It is currently resolved to the IP address 172.67.128.137, which belongs to Cloudflare, Inc. and is geolocated in Canada. The site presents a TLS certificate issued by Let’s Encrypt (certificate profile E7) and returns HTTP status 200 on all requests. Authoritative nameservers for the domain are braden.ns.cloudflare.com and katja.ns.cloudflare.com, confirming that the domain is fully proxied behind Cloudflare’s CDN. Reputation services show a Gridinsoft trust score of 0 out of 100 and the domain appears on four external blocklists. AlienVault OTX references the domain in a single threat‑intel pulse, and it is listed as blocked by multiple anti‑phishing feeds. The landing page is titled “$EVR Airdrop — Claim Your Reward Allocation | Evernode” and mimics a legitimate airdrop claim portal. Analysis of the page source matches the publicly available Airdrop Scam phishing kit, a known crypto‑drainer method that attempts to harvest private keys or wallet credentials. VirusTotal reports two detections out of ninety‑five scanners, indicating that some security engines have already flagged the site. Given the high‑risk rating and active status, defenders should block DNS resolution for claim-evr.org and any subdomains, enforce TLS inspection to capture credential submissions, and monitor for outbound connections to the Cloudflare edge IP 172.67.128.137. Incident response teams should also educate users about the fraudulent $EVR airdrop narrative and advise immediate revocation of any wallet credentials entered on the site.