secureddegenkapital[.]fun

Analysis of secureddegenkapital.fun confirms its classification as an active credential phishing domain targeting cryptocurrency users through an airdrop scam. The domain was registered on December 18, 2025, via Go Daddy, LLC, and currently resolves to IP address 216.150.16.193, hosted on Amazon.com, Inc. infrastructure (AS16509). Infrastructure analysis reveals the use of Vercel for hosting, with HSTS enabled and a Let's Encrypt SSL certificate (R12) deployed, suggesting an attempt to appear legitimate. The HTTP status code 307 indicates a temporary redirect, a common tactic in phishing campaigns to obscure the final malicious destination.

The domain is flagged by eight security vendors on VirusTotal, including PhishDestroy, which has explicitly blocked it. It also appears on one additional security blocklist, reinforcing its malicious status. The page title, 'SDK | SECURED DEGEN KAPITAL,' aligns with the identified phishing kit, labeled as an 'Airdrop Scam,' a known method for harvesting cryptocurrency wallet credentials or private keys. The domain's Gridinsoft trust score of 0/100 further corroborates its high-risk classification.

Nameservers ns43.domaincontrol.com and ns44.domaincontrol.com are consistent with Go Daddy's infrastructure, though this alone does not indicate compromise. The domain's recent creation date and immediate malicious activity suggest it was registered with fraudulent intent. Defenders should treat this domain as a confirmed phishing threat, block it at the network level, and monitor for related infrastructure, such as subdomains or associated IPs. While the exact content of the phishing page remains unanalyzed, the available evidence—including detection by multiple security vendors, blocklist presence, and alignment with known phishing kits—leaves no doubt about its malicious purpose.