# gasfees.top — SUSPICIOUS

> gasfees.top is a live cryptocurrency fee scam site confirmed by PhishDestroy. 1/95 VirusTotal flags. Check the full report.

## Summary
gasfees.top is confirmed as an active cryptocurrency-fee phishing domain deployed to steal user funds via fake gas-fee quotes. The risk level is elevated, meaning immediate avoidance and takedown actions are warranted to protect visitors and potential victims.

This domain was flagged by PhishDestroy with an elevated risk rating after sandbox analysis detected a live cryptocurrency-fee scam lure. VirusTotal reports 1 out of 95 security vendors flagged the domain. The SSL certificate is issued by Google Trust Services (GTS CA 1C3), showing a false veneer of legitimacy despite the malicious intent. Registrant information reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for accommodating high-risk registrations. The domain resolves to IP 172.67.188.207, a Cloudflare edge node frequently abused for quick-fire phishing campaigns. Registration occurred on November 25, 2025, a recent date indicating the campaign is still fresh and potentially expanding. Only 1/95 VirusTotal vendors currently detect the threat, highlighting the speed at which new phishing domains evade detection.

Mitigation steps include immediately blocking gasfees.top at DNS and network levels using reputable blocklists and SIEM rules. Users should avoid visiting the domain and clear any cached bookmarks or links referencing it. Cryptocurrency users should verify fee information only through official wallet interfaces and cross-check URLs before entering any payment details. Report the domain to hosting providers, registrars, and abuse channels to accelerate takedown efforts. Security teams should share Indicators of Compromise (IP 172.67.188.207, domain gasfees.top, registrar NICENIC INTERNATIONAL GROUP CO., LIMITED) with threat intelligence platforms to enhance collective defense against this fee-scamming operation.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2025-11-25 12:18:13
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 172.67.188.207

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/e7f0435a-48f9-42c9-9a09-8a785349b547
- PhishDestroy: https://phishdestroy.io/domain/gasfees.top/
- LLM endpoint: https://phishdestroy.io/domain/gasfees.top/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/gasfees.top/
Last updated: 2026-03-23