gensync[.]network

The domain gensync.network was registered on May 08, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It is currently classified as a generic phishing site with a high risk rating and remains active as of the report date (July 12, 2026). The site presents a page titled “Just a moment…” and returns an HTTP 403 status code, suggesting that content is being shielded behind a Cloudflare challenge. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. in Canada. The authoritative name servers are frida.ns.cloudflare.com and hayes.ns.cloudflare.com, confirming the use of Cloudflare’s DNS and edge services. TLS is provided by a Let's Encrypt certificate (issuer E7) and the site enforces HSTS while supporting HTTP/3, indicating a modern web stack designed to appear legitimate. Reputation data is strongly negative: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on two external blocklists. PhishDestroy and ScamSniffer have already blocked the domain, and one out of ninety‑five security vendors on VirusTotal flagged it as malicious. AlienVault OTX lists the domain in a single threat‑intelligence pulse, further corroborating its malicious use. Defenders should immediately block gensync.network at the DNS and proxy layers, and add the IP 188.114.97.3 to outbound and inbound deny lists. Email security gateways must be tuned to detect URLs pointing to this domain, and any existing incidents that reference the “Just a moment…” page should be investigated for credential harvesting. Continuous monitoring of Cloudflare‑hosted domains for similar patterns is advised, as the use of Cloudflare’s infrastructure can obscure the true origin of the phishing campaign.