portal-syncswap[.]xyz

The domain portal-syncswap.xyz was registered on April 14, 2026 through Dynadot LLC and is currently resolved to the IP address 188.114.97.3, which is hosted by CloudFlare, Inc. in Canada. The site serves an HTTPS certificate issued by Let’s Encrypt (issuer E7) and returns an HTTP 403 status for generic requests. Security telemetry shows the domain appears on a single blocklist and has a Gridinsoft trust score of 0 out of 100, indicating a high likelihood of malicious use.

Threat intelligence sources classify the activity as generic_phishing with a high risk rating. VirusTotal analysis flags the domain by 2 of 95 security vendors, and AlienVault OTX records it in one threat‑intelligence pulse. The domain is also listed as blocked by PhishDestroy. Nameserver configuration uses malcolm.ns.cloudflare.com and raquel.ns.cloudflare.com, both Cloudflare‑managed.

While the HTTP 403 response suggests the front‑end is intentionally restricting access, the presence of a valid TLS certificate and Cloudflare front‑end is consistent with credential‑harvesting campaigns that hide malicious payloads behind legitimate‑looking pages. The limited detection count (only two vendor flags) leaves open the possibility that the phishing infrastructure is newly deployed or employing evasion techniques that avoid broader detection.

Defenders should add portal-syncswap.xyz to URL filtering rules and block traffic to its resolving IP 188.114.97.3. Monitoring of DNS queries for the associated Cloudflare nameservers is advised, as well as continuous re‑scanning with updated threat‑intel feeds. Incident response teams should treat any credential submissions to this domain as compromised and advise affected users to reset credentials immediately.