snapshot-ethgasfoundation[.]org

This domain, snapshot-ethgasfoundation.org, is flagged as an active NFT scam infrastructure as of July 25, 2026. Registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to IP 172.67.184.26, hosted on Cloudflare's network (AS13335) in the United States. The nameservers (kami.ns.cloudflare.com, matteo.ns.cloudflare.com) and SSL certificate (Google Trust Services / WE1) further indicate Cloudflare's involvement in its hosting and security proxying. The domain currently returns an HTTP 403 status with the page title 'Just a moment...', a common response from Cloudflare when filtering or challenging requests, which may obscure the actual phishing content from automated scans. Analysis reveals the domain is detected by 3 of 93 security vendors on VirusTotal, though this does not confirm its malicious nature definitively.

It appears on one security blocklist and is identified in a single AlienVault OTX threat intelligence pulse, suggesting limited but confirmed malicious activity. The domain is also blocked by PhishDestroy, reinforcing its classification as a high-risk threat. Gridinsoft assigns a trust score of 0/100, indicating no confidence in its legitimacy. Technologies detected include Cloudflare Browser Insights and HTTP/3, typical of modern web infrastructure but not inherently malicious.

The scam type is explicitly classified as an NFT scam, though the exact mechanics or targeted brands remain unconfirmed due to the lack of visible page content. Defenders should treat this domain as hostile and prioritize blocking it at the DNS, IP, and proxy levels. Monitoring for related domains registered through the same registrar or utilizing identical Cloudflare nameservers may help identify additional threats. Given its active status and confirmed presence on blocklists, immediate containment is recommended to prevent potential user exposure.