degeninsol[.]xyz

The domain degeninsol.xyz is flagged as a high‑risk, generic phishing indicator. It was registered on April 18, 2026 through PublicDomainRegistry.com and is hosted on Cloudflare infrastructure, resolving to the IP address 172.67.185.221 located in Canada. The authoritative nameservers are kelly.ns.cloudflare.com and trace.ns.cloudflare.com, confirming the use of Cloudflare DNS services.

Infrastructure analysis shows the site serves a valid SSL certificate issued by Google Trust Services under the WE1 designation, yet HTTP requests receive a 403 response, indicating that the web server is deliberately denying access to standard queries. The domain appears on three security blocklists and is explicitly blocked by multiple threat mitigation lists, including PhishDestroy, SEAL, and a MetaMask blocklist. VirusTotal currently reports zero detections out of 95 scanners, which should not be interpreted as a safety signal given the active blocklist status.

Threat intelligence sources record the domain in a single AlienVault OTX pulse, and its presence on three blocklists reinforces the classification as a phishing infrastructure. No public page content has been analyzed, so the exact lure or credential‑harvesting technique remains uncertain. The lack of detections on VirusTotal may reflect limited exposure rather than benign intent.

Defenders should treat degeninsol.xyz as a malicious actor and enforce network‑level blocking or URL filtering to prevent client access. Continuous monitoring of DNS resolutions for the associated Cloudflare IPs is advised, as the domain could be repurposed or linked to additional malicious payloads. Adding the domain to internal blocklists and sharing the indicator with upstream security feeds will help mitigate potential phishing campaigns targeting users.