eversol[.]one

This domain, eversol.one, is actively impersonating the Eversol brand as part of an airdrop scam operation. Analysis indicates the site presents itself as an official Eversol airdrop portal, with the page title explicitly displaying 'Eversol | Airdrop.' The domain was registered on May 24, 2026, through NameCheap, Inc., and currently resolves to the IP address 188.114.97.3. Security vendors have flagged this domain as malicious, with 8 out of 95 engines on VirusTotal detecting it as a threat. Additionally, the domain appears on four security blocklists and has been included in 16 threat intelligence pulses on AlienVault OTX, further confirming its association with malicious activity. Infrastructure analysis reveals the use of a Let's Encrypt SSL certificate, which, while providing basic encryption, is commonly exploited by threat actors to lend legitimacy to fraudulent sites. The domain's trust score from Gridinsoft is 0 out of 100, reinforcing its classification as high-risk. The presence of a known airdrop scam phishing kit suggests the site is designed to deceive users into disclosing sensitive information or transferring assets under false pretenses. The domain remains active as of July 12, 2026, with no indications of takedown or mitigation efforts. Defenders should prioritize blocking this domain at the network level, particularly in environments where cryptocurrency or decentralized finance activities are common. Monitoring for connections to the IP address 188.114.97.3 may also help identify compromised systems or users attempting to interact with the scam. Given the domain's inclusion in multiple threat intelligence feeds and blocklists, organizations should cross-reference internal logs for any prior engagement with eversol.one and investigate potential exposure. The use of automated detection rules targeting known airdrop scam patterns may assist in identifying similar threats in the future.