claim[.]ethgas[.]click

PhishDestroy identifies claim.ethgas.click as an active crypto drainer domain currently under investigation for malicious activities targeting cryptocurrency users.

This domain was flagged for its role as a crypto drainer, designed to illicitly transfer funds from victims' wallets. According to available intelligence, the domain was registered through DYNADOT LLC on March 31, 2026, and resolves to the IP address 172.67.190.10. The domain operates with a Let's Encrypt SSL certificate, which may contribute to its perceived legitimacy. As of the latest check, VirusTotal reports 0 detections out of 95 vendors, indicating that it has not yet been widely flagged by security solutions. The domain's recent creation and lack of detections suggest it may still be in an early stage of deployment or undetected by many security tools.

Given the active status of this domain and its association with crypto drainer activity, organizations and individuals should treat it as a high-risk threat. Concrete recommendations include blocking the domain and IP address at the network perimeter, updating endpoint detection rules to monitor for connections to this domain, and educating users about the risks of interacting with unsolicited links or websites. Additionally, security teams should monitor for any connections to the associated IP address, 172.67.190.10, and consider investigating any past or present interactions with claim.ethgas.click as part of incident response efforts.