syntetix[.]io

Analysis indicates that syntetix.io is an active phishing domain targeting users of the Synthetix cryptocurrency platform. The domain was registered on August 22, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and remains operational as of July 22, 2026. It resolves to the IP address 188.114.96.3, which is hosted on Cloudflare infrastructure, as evidenced by its nameservers (grace.ns.cloudflare.com and ivan.ns.cloudflare.com).

The domain has been flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a high-risk threat. No recent VirusTotal scan results are available to confirm current detections, though the absence of vendor flags does not validate safety. The domain's registration details and hosting provider align with patterns observed in cryptocurrency-related phishing campaigns, where attackers exploit Cloudflare's services to obscure infrastructure and evade takedowns.

Defenders should treat this domain as malicious and prioritize blocking it at the DNS and network levels. Organizations using Synthetix or related DeFi services should alert users to avoid interaction with syntetix.io and monitor for credential theft or wallet-draining attempts. Further investigation into the site's content and backend infrastructure is recommended to determine the exact phishing kit or lure being deployed.