degen[.]foundations[.]xyz

This domain, degen.foundations.xyz, has been identified as a crypto drainer phishing site targeting users of decentralized finance (DeFi) platforms. The threat involves luring victims into connecting their cryptocurrency wallets to a malicious interface, which then executes unauthorized transactions to drain funds. The domain mimics legitimate DeFi project infrastructure, leveraging social engineering tactics to exploit user trust in blockchain-based applications. Analysis of the site’s behavior indicates automated wallet-draining scripts, a common characteristic of crypto-focused phishing campaigns observed in recent threat intelligence reports. Evidence supporting this assessment includes detection by 4 out of 95 security vendors on VirusTotal, with the domain registered through Interstellar Registrar Limited on February 21, 2026. The domain resolves to the IP address 143.244.211.82 and is currently listed on one security blocklist. Infrastructure analysis reveals the use of Google Tag Manager and Google Analytics, likely for tracking victim interactions, alongside HTTP/3 for improved performance and evasion of legacy security controls. The SSL certificate is issued by Let’s Encrypt, a common choice among threat actors to lend superficial legitimacy to malicious sites. The domain’s creation date, set in the future (2026), suggests an attempt to bypass automated age-based reputation checks. Users who visited degen.foundations.xyz or interacted with its content should immediately revoke any wallet connections associated with the site. All connected cryptocurrency wallets should be audited for unauthorized transactions, with particular attention to outgoing transfers to unfamiliar addresses. If funds were compromised, victims are advised to report the incident to relevant blockchain analytics platforms and law enforcement agencies specializing in cybercrime. Additionally, affected users should monitor their devices for secondary infections, as phishing sites of this nature may deploy additional malware payloads. Proactive measures, such as resetting browser sessions and clearing cached data, are recommended to mitigate residual risks.