degenstein[.]xyz

PhishDestroy forensic analysis confirms degenstein.xyz operates as a crypto drainer phishing domain designed to trick cryptocurrency users into connecting their wallets and authorizing unauthorized transactions. The domain was flagged with a generic_phishing threat classification on August 17 2025, indicating a high-risk campaign targeting digital asset holders. Technical artifacts and behavioral patterns align with known drainer kit toolkits that simulate legitimate blockchain interfaces to harvest private keys and seed phrases.

Technical indicators place this domain at elevated risk: it resolves to IP address 216.198.79.65, carries a legitimate Let's Encrypt SSL certificate, and was registered through TUCOWS.COM, CO. VirusTotal analysis shows only 1 out of 95 security vendors detected the threat as of the seed timestamp c16cff. This low detection rate suggests either a new campaign or evasion tactics designed to bypass automated scanning. The domain has not been flagged by Google Safe Browsing and currently shows minimal presence in public threat intelligence feeds.

As of analysis completion, degenstein.xyz remains active and unresolved. Security teams recommend blocking the domain at network and endpoint levels using the IP 216.198.79.65 and registrar TUCOWS.COM registration data. Users should avoid visiting the site, and cryptocurrency wallet extensions should be monitored for unauthorized connections. The residual risk remains elevated due to the active campaign window and low signature coverage, indicating ongoing potential for successful compromise of unwary users.