app-ethgas[.]com

app-ethgas.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to 172.67.175.131, an address owned by Cloudflare (AS13335) located in the United States. The domain is currently taken offline; the last observed HTTP response returned a generic page titled “Just a moment…”, indicating Cloudflare’s interstitial protection page rather than a malicious landing page. The site employed Cloudflare services, including Browser Insights and HTTP/3, and presented a Google Trust Services / WE1 SSL certificate, which is typical for Cloudflare‑proxied domains and does not imply legitimacy. Threat intelligence classifies the domain as a crypto‑related phishing operation.

It appears on four security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. AlienVault OTX lists the domain in one pulse, reinforcing its association with malicious activity. VirusTotal analysis shows six of ninety‑five scanning engines flagging the domain, providing additional corroboration of its malicious nature. Defenders should treat any DNS resolution of app-ethgas.com as high‑risk.

Network controls ought to block outbound connections to 172.67.175.131 when associated with this FQDN, and email or web gateway filters should reference the known blocklist entries. Because the domain is hosted behind Cloudflare, traditional IP‑based blocking may affect legitimate Cloudflare customers; therefore, policy should prioritize domain‑level denial. Continuous monitoring of the domain’s registration status and any re‑appearance of content is advised, and incident response teams should investigate any authentication attempts or credential submissions that reference the domain, especially those targeting cryptocurrency wallets.