claim[.]gasfeegoose[.]space

This domain, claim.gasfeegoose.space, was registered on 2026-02-21 through Hostinger operations (UAB) and resolves to IP 212.1.212.5. The host resides in the United States under ASN 47583, owned by Hostinger International Limited. DNS resolution is provided by ns1.dns-parking.com and ns2.dns-parking.com, both typical of rapidly provisioned or parked domains. No TLS certificate is presented, and HTTP requests return a 403 status, indicating deliberate access restriction while remaining reachable by automated scanners.

The site is flagged by PhishDestroy and appears on one external blocklist. Reputation scoring services assign a Gridinsoft trust score of 0 out of 100, reflecting a lack of benign reputation. VirusTotal scans have returned 0 detections out of 95 engines, which does not imply safety given the absence of known signatures. The combination of a newly created domain, low trust score, and blocklist inclusion points to malicious intent.

Analysis of the page title, "Gas Fee Goose - GOOSE Token Airdrop," together with the listed scam type "wallet_connect_phish" identifies the operation as an airdrop‑style wallet‑connect phishing kit. The domain is explicitly marked as impersonating the brand "base," suggesting that any wallet‑connect prompts presented to victims will appear to originate from the legitimate Base platform. The kit likely leverages the popular airdrop narrative to lure users into authorizing malicious wallet connections.

Defenders should add claim.gasfeegoose.space to network deny lists and configure web proxies to block any HTTP requests to the host. Continuous monitoring of DNS queries for the associated nameservers and the IP address 212.1.212.5 is advised, as the infrastructure may be reused for additional malicious domains. Threat‑intel sharing platforms should be updated with the observed indicators, and security teams should educate users about unsolicited wallet‑connect requests that reference Base or airdrop incentives.