degen[.]airdropsalert[.]xyz

This report details a malicious domain, degen.airdropsalert.xyz. The site was configured to impersonate the Gmail brand, as indicated by its page title of "Google" and its classification as a Gmail impersonation. The threat posed is a cryptocurrency scam, likely designed to trick users into revealing credentials or other sensitive information under the guise of a legitimate Google service, facilitating unauthorized access or financial theft.

Technical analysis confirms the site's malicious intent. VirusTotal flagged the domain with 13 detections out of 95 scanners. It was specifically flagged by ChainPatrol, BitDefender, CRDF, CyRadar, and ESET, and appears on 1 blocklist. The domain was registered through Dynadot LLC on 2025-10-17, hosted on IP address 142.250.186.164 (United States, AS15169 Google LLC), and uses nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. The site has no SSL certificate.

As of the time of analysis, the domain is DOWN or OFFLINE. The risk level is high, indicated by a GridinSoft trust score of 0 out of 100 and a DOM risk score of 25. The combination of brand impersonation, cryptocurrency scam targeting, and high detection rate underscores a significant threat, though the site is currently inaccessible.