votes-ethgasfoundation[.]xyz

Analysis of votes-ethgasfoundation.xyz confirms that the domain is being used for a brand impersonation campaign targeting Ethereum users. The site was registered on February 24, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare IP address 188.114.96.3, which is located in the United States and belongs to ASN 13335 (Cloudflare, Inc.). No SSL certificate is presented, indicating that the HTTP service is insecure. The page title returned by the server, "Governing Realtime Ethereum | ETHGas Foundation," suggests an attempt to masquerade as an official Ethereum gas‑monitoring service, aligning with the documented crypto scam classification.

The domain appears on three security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its malicious intent. VirusTotal scans report that two of ninety‑three security vendors flagged the domain, providing additional corroboration of its suspicious nature. Nameserver records list felicity.ns.cloudflare.com and lia.ns.cloudflare.com, both standard Cloudflare resolvers, which is consistent with the hosting provider. The current operational status is offline, which may be a temporary takedown or a deliberate shutdown after detection.

Defenders should continue to enforce blocklist rules for this domain, monitor the associated IP range for related activity, and update endpoint protection signatures to include the observed indicators. Because the site lacks an SSL certificate, any future re‑appearance would be detectable via TLS fingerprinting. Ongoing surveillance of the registrar NiceNIC and the Cloudflare infrastructure is recommended to identify potential re‑registration attempts or new domains using similar branding cues.