ethgashub[.]xyz

This domain, ethgashub.xyz, is identified as a credential harvesting site targeting Ethereum wallet users. Analysis indicates the threat type is generic phishing with a focus on cryptocurrency theft. The domain is currently offline, though prior activity suggests it was designed to mimic legitimate Ethereum-related services to deceive users into disclosing private keys or recovery phrases. Infrastructure analysis reveals the domain was flagged by 4 of 95 security vendors on VirusTotal, indicating moderate detection but clear malicious intent. It was registered through NiceNIC International Group Co., Limited on February 21, 2026, and resolved to the IP address 172.67.171.5, a Cloudflare-hosted endpoint. The domain appears on one security blocklist and was previously blocked by a specialized phishing detection system. Technical indicators include the use of HSTS, Cloudflare, and HTTP/3, which are commonly employed to obfuscate malicious infrastructure and evade detection. The domain’s current offline status reduces immediate risk, but historical activity and infrastructure patterns suggest potential for reactivation. Organizations and individuals are advised to monitor for renewed activity under this domain or similar variants. Network-level blocking of the IP 172.67.171.5 is recommended as a precautionary measure. Users who may have interacted with this domain should immediately revoke any exposed credentials, enable multi-factor authentication where available, and conduct a security audit of associated accounts or wallets. Cryptocurrency users are reminded to verify domain authenticity before entering sensitive information and to rely on official, verified sources for wallet management.