degen[.]ir

Analysis of degen.ir shows a newly registered domain (created February 21, 2026) hosted on an Apache HTTP Server and resolving to IP 195.28.11.70, which is attributed to AS47376 Web Gostaran Bandar Company (PJS) in Iran. The site serves over HTTPS with an R13 certificate and returns HTTP status 200. The page title reported by crawlers is "HiGate," offering no further contextual clues about the content or target audience.

The domain is currently listed on a single security blocklist and holds a Gridinsoft trust score of 0 out of 100, indicating a high confidence of malicious intent. VirusTotal scans have flagged degen.ir with four detections out of ninety‑five vendors, and the domain is actively blocked by PhishDestroy, reinforcing its classification as a generic phishing threat. The risk assessment assigned by the reporting system is high, and the status remains active, suggesting ongoing exploitation.

Defenders should prioritize immediate containment actions. Network controls ought to block outbound connections to 195.28.11.70 and prevent DNS resolution of degen.ir. Email security gateways must be updated to flag any messages containing links to this domain, and intrusion detection signatures should be tuned to detect HTTP requests to the host. Continuous monitoring of related ASN traffic and periodic re‑scans of the domain are recommended to capture any changes in its threat posture, while incident response teams should be prepared to investigate any compromise reports that reference the HiGate page title or associated IP infrastructure.