degen-organization[.]gitbook[.]io

This domain, degen-organization.gitbook.io, is identified as a crypto drainer phishing site targeting users of the Noble Degen platform. The threat involves luring victims into connecting cryptocurrency wallets to malicious smart contracts or scripts designed to drain funds without authorization. The page title, 'Welcome! | Noble Degen Docs,' suggests an attempt to impersonate official Noble Degen documentation, increasing the likelihood of user deception through familiarity and trust in the brand name.

Analysis indicates the domain was registered on March 30, 2014, through Cloudflare, Inc., and currently resolves to the IP address 172.64.147.209. It is flagged by 2 out of 95 security vendors on VirusTotal, and appears on one security blocklist. The SSL certificate is issued by Google Trust Services, and the site employs Cloudflare infrastructure with HTTP/3 support. Despite its long registration history, the domain exhibits characteristics consistent with phishing operations, including recent malicious activity and a lack of legitimate association with the Noble Degen brand.

Users who visited degen-organization.gitbook.io should immediately disconnect any connected wallets and revoke permissions for suspicious smart contracts via wallet management tools. It is recommended to scan the device for malware, change passwords for cryptocurrency-related accounts, and monitor wallet activity for unauthorized transactions. If funds were transferred, report the incident to relevant blockchain analytics platforms and law enforcement with transaction hashes and timestamps for further investigation.