degencity-online[.]net

Analysis of degencity-online.net, observed on July 26, 2026, indicates that the domain is actively being used in a generic phishing campaign. The domain was registered on July 22, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on the IP address 104.21.38.86, which is served by Cloudflare nameservers athena.ns.cloudflare.com and mark.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 designation, confirming that the connection is encrypted but providing no assurance about the legitimacy of the underlying content.

VirusTotal records show that the domain has been scanned by 91 security vendors, none of which have flagged it as malicious at the time of analysis; this lack of detection does not constitute evidence of safety. Independent blocklist monitoring confirms that the domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the suspicion of phishing activity. No additional intelligence such as page title, brand targeting, or malware kit identifiers is available, leaving the exact content of the site unverified.

Defenders should treat the domain as malicious until further forensic evidence is obtained. Recommended actions include adding the domain to local deny lists, monitoring DNS queries for the associated IP, and employing URL filtering to block access. Continuous re‑evaluation is advised, as the domain remains active and may evolve its tactics or infrastructure.