degenwhale[.]site

Analysis of degenwhale.site shows it is a newly registered domain (created 2025-12-01) hosted on Hostinger’s DNS parking service. The authoritative nameservers are ns1.dns-parking.com and ns2.dns-parking.com, and the domain resolves to the IP address 84.32.84.32, which belongs to AS47583 Hostinger International Limited located in Lithuania. No TLS certificate is presented, indicating the site is served only over HTTP. The page title returned by the HTTP response is “Parked Domain name on Hostinger DNS system”, confirming that the domain is currently parked rather than delivering malicious content.

Despite the parked status, the domain is listed on two public security blocklists and is actively blocked by PhishDestroy and ScamSniffer, reflecting its classification as a phishing vector. VirusTotal scans have flagged the domain in six of ninety-five AV engines, providing additional corroboration of malicious intent. AlienVault OTX records a single threat‑intel pulse referencing the domain, further evidencing its use in abuse campaigns. The current operational status is marked as offline, suggesting the payload may have been removed or the site taken down, but the infrastructure remains observable.

Uncertainty remains regarding the specific phishing campaign, target victims, or any payload that may have been hosted before takedown, as no content analysis is available beyond the parked page title. Defenders should continue to block the domain at network perimeter, update DNS filtering rules, and monitor for re‑activation. Incident response teams should also query historical archives for any cached content that could reveal credential‑stealing forms or malicious redirects, and consider enriching threat‑intel feeds with the observed indicators (IP 84.32.84.32, AS47583, Hostinger DNS parking).