degen-5[.]gitbook[.]io

The domain degen-5.gitbook.io has been identified as a brand impersonation threat, specifically targeting the Telegram platform. This malicious domain is currently offline, having been taken down after being flagged for deceptive activities designed to mimic Telegram's brand and potentially steal user credentials or crypto assets. The site posed as 'Degen | Degen: A Smart Way to Telegram&Crypto', a fake platform that leveraged Telegram's reputation to lure unsuspecting users.

According to available intelligence, degen-5.gitbook.io was flagged by 15 out of 95 VirusTotal vendors as malicious, and Google Safe Browsing also marked it as phishing. The domain was registered through Cloudflare, Inc., and was created on March 30, 2014. It resolves to IP address 104.18.40.47 and uses an SSL certificate from Google Trust Services (WE1). The domain appears on one security blocklist and had a low trust score due to the high number of security vendor flags. Despite its age, the domain was recently repurposed for malicious activity.

Since the domain has been taken offline, the immediate risk is reduced, but users should remain vigilant. PhishDestroy recommends avoiding any interaction with degen-5.gitbook.io or similar lookalike domains. Users should verify the authenticity of Telegram-related services by visiting official sources directly and report any suspicious domains to security teams. It is also advisable to enable two-factor authentication on Telegram accounts and avoid entering credentials on unverified sites.