degenlab-whitepaper[.]gitbook[.]io

The domain degenlab-whitepaper.gitbook.io is currently active and classified as a high‑risk brand‑impersonation campaign. Infrastructure analysis shows the domain resolves to IP address 172.64.147.209, which is hosted within a United States‑based content delivery network (ASN 13335). Registration data indicates the domain was created on March 30, 2014 and is managed through a widely used DNS provider, with authoritative nameservers dahlia.ns.cloudflare.com and hugh.ns.cloudflare.com. The site presents a valid SSL certificate issued by a well‑known certificate authority (Google Trust Services / WE1), confirming encrypted communication.

Reputation signals include a Gridinsoft trust score of 0/100 and a Google Safe Browsing flag for SOCIAL_ENGINEERING. VirusTotal reports that 12 out of 95 scanning engines have flagged the domain as malicious. HTTP response code 307 indicates a temporary redirect, which is commonly used to forward victims to a malicious payload. The domain appears on at least one public security blocklist and is blocked by multiple security tools, reinforcing its malicious intent.

The page title "Concept | Degen Lab" suggests the site is attempting to mimic or reference the Degen Lab brand, though the exact content of the page has not been examined. The brand target is listed as "across," indicating a broad impersonation scope.

Defenders should block DNS resolution for the domain, enforce URL filtering based on the observed IP address, and monitor for redirects to the 307 location. Endpoint security solutions should be updated to include the domain in threat‑intel feeds, and users should be warned about potential credential harvesting attempts associated with this brand‑impersonation vector. Continuous monitoring is advised, as the infrastructure could be repurposed for additional malicious activity.