claim[.]ethergas[.]icu

The domain claim.ethergas.icu was registered on March 27, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It is currently classified as a crypto drainer with a specific fake‑airdrop scam profile and is listed as active under investigation. The site returns an HTTP 403 status and the only visible page title is “Just a moment…”. No additional content has been captured, so the exact user‑facing experience remains unknown. Infrastructure analysis shows the domain resolves to the IP address 172.67.135.142, which is owned by Cloudflare, Inc. and located in Canada. Authoritative name servers are owen.ns.cloudflare.com and elaine.ns.cloudflare.com, confirming the use of Cloudflare’s DNS and CDN services. The TLS certificate is issued by Let’s Encrypt, identifier “E7”, providing a valid HTTPS endpoint despite the 403 response. Threat intelligence indicates the domain is part of a fake‑airdrop campaign designed to lure cryptocurrency holders into submitting private keys or authorizing transactions, characteristic of a crypto‑drainer operation. The site is currently flagged by PhishDestroy and appears on one external security blocklist, while a Gridinsoft trust score of 0 out of 100 reflects a highly malicious rating. VirusTotal has recorded zero detections across 95 scanners, which does not imply safety given the low visibility of the payload. Defenders should prioritize blocking claim.ethergas.icu at network perimeter and DNS layers, and monitor outbound connections to the associated Cloudflare IP range for anomalous activity. Continuous re‑evaluation is advised, as the domain’s short lifespan and recent registration suggest a rapid‑deployment campaign. Incident response teams should treat any credential or wallet information submitted to this domain as compromised and advise affected users to revoke access and secure their assets.