0xdegen[.]xyz

Analysis of the domain 0xdegen.xyz indicates it was actively involved in an airdrop-themed phishing campaign prior to being taken offline. Registered on October 14, 2025, through NiceNIC International Group Co., Limited, the domain resolved to the IP address 188.114.96.3, which is associated with Cloudflare, Inc. (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (gannon.ns.cloudflare.com and phoenix.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. No SSL certificate was detected, increasing the likelihood of interception or manipulation of unencrypted traffic. At the time of assessment, the domain returned an HTTP 522 status (Connection timed out), suggesting it was either voluntarily disabled or forcibly suspended.

Security vendor detections on VirusTotal flagged the domain as malicious in 6 out of 95 scans, while it appeared on one security blocklist and was blocked by PhishDestroy. AlienVault OTX included the domain in a single threat intelligence pulse, reinforcing its association with phishing activity. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The scam type has been identified as an airdrop phishing kit, a scheme typically targeting cryptocurrency users with fraudulent token distributions.

While the exact content of the phishing page remains unanalyzed, the combination of detection counts, blocklist inclusions, and threat intelligence references confirms its role in the campaign. Defenders are advised to treat this domain as a confirmed threat vector, particularly in environments where cryptocurrency-related activity is prevalent. Monitoring for related infrastructure, such as newly registered domains under the same registrar or IP range, may help identify follow-on campaigns. Given the domain's current offline status, no immediate risk of user exposure exists, but historical logs should be reviewed for prior interactions.