airdrop[.]degenbase[.]trade

This domain, airdrop.degenbase.trade, is identified as a brand impersonation phishing infrastructure targeting Metamask, a widely used cryptocurrency wallet. The page title "Degenbase" suggests an attempt to mimic legitimate airdrop or decentralized finance (DeFi) platforms, likely designed to deceive users into disclosing wallet credentials or private keys. No specific drainer kit has been conclusively linked to this domain, though the tactics align with common cryptocurrency phishing campaigns observed in recent threat landscapes.

Infrastructure analysis reveals the domain was registered on October 03, 2025, through Porkbun LLC and currently resolves to the IP address 76.76.21.9. Security vendor detections on VirusTotal indicate 4 out of 95 engines flagged the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and is blocked by at least one threat intelligence feed. No detections were reported on Google Safe Browsing at the time of analysis, though the Scamadviser trust score of 26/100 further corroborates its suspicious nature.

As of the latest assessment, airdrop.degenbase.trade has been taken offline, likely due to registrar or hosting provider intervention. While the immediate threat is mitigated, the domain's registration details and infrastructure remain relevant for historical tracking. Users who interacted with the domain prior to its takedown may still be at risk of credential compromise or financial loss. Organizations are advised to monitor for related domains registered under the same registrar or resolving to the same IP range, as threat actors often reuse infrastructure across campaigns.