ethgasfoundation[.]net

The domain ethgasfoundation.net was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently taken offline. It resolves to the Cloudflare address 172.67.166.9, located in the United States and advertised under ASN AS13335 Cloudflare, Inc. The domain uses the Cloudflare nameservers gigi.ns.cloudflare.com and kayden.ns.cloudflare.com, but no TLS certificate was observed, indicating an unencrypted HTTP service at the time of analysis. The only publicly visible content is the page title "Governing Realtime Ethereum | ETHGas Foundation," which does not reference the claimed target brand. The intelligence set classifies the campaign as a crypto scam that impersonates Discord, falling under the broader category of brand impersonation.

Detection infrastructure shows that the domain is listed on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal recorded five positive detections out of ninety‑three scanners, and AlienVault OTX references the domain in a single threat‑intel pulse. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. No additional forensic artefacts such as login pages or credential‑stealing scripts were captured, leaving the exact phishing payload unknown.

Defenders should continue to block the IP address 172.67.166.9 and the domain name across network filters and endpoint protection suites. Monitoring for re‑registration or reuse of the same nameservers is advisable, as the underlying Cloudflare infrastructure can be repurposed for future campaigns. Given the lack of TLS, any attempted connections would be exposed in clear text, providing an opportunity for traffic inspection. Organizations should also educate users about unsolicited Discord‑related communications that reference Ethereum or gas pricing, as the page title suggests an attempt to lure cryptocurrency‑aware victims.