gasfees[.]top

Analysis of the domain gasfees.top indicates that it was actively serving a phishing page titled “GasBack Protocol” before being taken offline. The registration record shows the domain was created on 25 November 2025 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolves to the Cloudflare‑owned address 172.67.188.207, which is geolocated to Canada. The authoritative nameservers janet.ns.cloudflare.com and logan.ns.cloudflare.com confirm that the site leveraged Cloudflare’s CDN and HTTP/3 transport.

Additional technology fingerprints include jsDelivr and a TLS certificate issued by Google Trust Services, both of which are commonly used to lend legitimacy to malicious sites. The domain is listed on four independent security blocklists and has been flagged by the anti‑phishing services PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal reports a single positive detection out of ninety‑four scanning engines, indicating at least one vendor identified malicious behavior. No public Safe Browsing or Open Threat Exchange entries are referenced in the available data, so the presence of the domain in those feeds cannot be confirmed at this time.

Given the combination of a recent creation date, use of reputable CDN infrastructure, a misleading page title, and corroborating detections from multiple phishing‑specific blocklists, the domain should be treated as a confirmed generic phishing vector. Defenders should continue to block the domain at the DNS and web‑proxy layers, monitor for any re‑appearance of the host under the same IP or similar sub‑domains, and ensure that endpoint protection solutions are updated with the latest indicator of compromise. Because the site is currently offline, any active traffic is likely residual; however, threat actors may re‑activate the domain or copy its infrastructure, so ongoing vigilance is advised.