app-fuel[.]com

The domain app-fuel.com was observed on 12 July 2026 delivering a brand‑impersonation campaign targeting the broader crypto community. The page title "Claim Your Share of the Arbitrum Ecosystem | Up to $25,000 for Active Wallets" aligns with the listed scam type "airdrop_scam". The site is currently active and returns HTTP 200.

Infrastructure analysis shows the domain resolves to the IPv4 address 45.9.148.51, which is hosted in the Netherlands and belongs to AS49447 Nice IT Services Group Inc. The domain was registered on 21 February 2026 through Aquila Domains LLC and uses the default Afternic nameservers ns1.afternic.com, ns2.afternic.com, and verification-d3jclucsp89ganyqbydeny.ns. The SSL certificate is identified as "R11". Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single public blocklist.

Threat intelligence indicates the site is already blocked by PhishDestroy and has been flagged by 11 of 95 security vendors on VirusTotal. The campaign impersonates "across", suggesting the attacker is attempting to lure victims across multiple platforms rather than a single brand. While the page title and scam type are confirmed, the exact content of the landing page has not been captured, leaving open the possibility of additional malicious payloads or credential‑harvesting forms.

Given the high‑risk classification, defenders should block DNS resolution for app-fuel.com at the network perimeter and add the IP 45.9.148.51 to any outbound filtering lists. Security monitoring should include alerts for HTTP 200 responses from this host and any traffic matching the airdrop‑scam keyword pattern. Continuous re‑assessment is advised, as further indicators may emerge if the attacker modifies the page or expands the infrastructure.