eligible-ethgas[.]com

This domain, eligible-ethgas.com, poses as an Espresso Claim Portal to deceive users into interacting with malicious cryptocurrency infrastructure. Analysis indicates the site likely functions as a crypto drainer or credential harvester, targeting users expecting legitimate token claims or airdrops. Visitors may be prompted to connect wallets or enter private keys, leading to unauthorized fund transfers or account compromise. The domain specifically exploits the Espresso brand, a known blockchain project, to lend false credibility to its operations. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to the IP address 104.21.13.61 and is currently flagged by 5 out of 95 security vendors on VirusTotal. The domain appears on three independent security blocklists and has been actively blocked by multiple wallet security tools. The page title, 'Espresso Claim Portal,' directly mimics legitimate claim portals, increasing the likelihood of successful social engineering attacks. Users who visited eligible-ethgas.com should immediately revoke any connected wallet permissions and monitor their accounts for unauthorized transactions. If private keys or seed phrases were entered, affected wallets must be considered compromised, and funds should be transferred to a new, secure wallet. Check connected applications and dApps for suspicious authorizations linked to this domain. Report the incident to relevant security teams and consider updating security configurations, such as enabling transaction simulation tools or hardware wallet protections. The domain is currently offline, but similar threats may reappear under different addresses or domains.