Domain security and threat intelligence

syncbitreasury[.]icu

Phishing and security check for syncbitreasury.icu

Threat verdict Critical 73/100 evidence score

Availability Unverified Current reachability is unverified

Risk signals

Spamhaus DBL: DBL_SPAM URLQuery threat systems: 1 alert Young domain: 2 days old

URLQuery: 1 threat alerts Aug 7, 2026 CDN

Risk score: 73 out of 100. Risk level: Critical.

Evidence Summary

CRITICAL

syncbitreasury.icu entered the PhishDestroy evidence set on Aug 7, 2026. The assembled evidence scores 73/100 (high).

Two independent sources are positive: Spamhaus DBL and URLQuery. Spamhaus DBL: DBL_SPAM on Aug 7, 2026 at 14:30 UTC. URLQuery recorded 1 threat-system alert on Aug 7, 2026 at 14:39 UTC. The evidence is not unanimous. On Aug 7, 2026 at 13:35 UTC, VirusTotal recorded 0 detections among 91 engines; Google Safe Browsing returned no flag; URLScan captured the page. The external blocklist snapshot contained no matches on Aug 7, 2026 at 14:20 UTC. The 0/91 VirusTotal result therefore records detection disagreement at that collection time, not the absence of the later source findings.

The collector marked the hostname reachable on Aug 7, 2026 at 13:35 UTC, but did not retain the HTTP response code. Registration records for the domain list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar and Aug 5, 2026 as the creation date. Registration preceded first observation by 2 days. At collection time, the hostname resolved to 188.114.97.3 on AS13335 (Cloudflare, Inc.). The recorded endpoint location is Toronto, CA. The stored server header is cloudflare. DOM analysis completed on Aug 7, 2026 at 14:20 UTC; stored DOM score 73/100. The evidence archive retains 4 visual captures from PhishDestroy, URLScan, URLQuery, and Cloudflare Radar. TLS metadata lists Google Trust Services as the certificate issuer with validity through Nov 3, 2026; checked Aug 7, 2026 at 16:02 UTC.

No page title was retained; the visual captures, not a title string, preserve the landing-page appearance. No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. Taken together, the page content and independent findings support classifying this hostname as phishing. The stored record does not establish the post-click interaction, and it does not claim a confirmed wallet-draining transaction or credential submission.

VirusTotal

0 det.

URLQuery

1 threat alert

URLScan

Report ↗

Gridinsoft

0/100

TLS Certificate

Google Trust Services

Age

2d Brand New!

Observed status

Unverified

DestroyList

Listed

Data coverage VirusTotal checked — no detections recorded URLQuery 1 threat-system alert PhishStats not checked OTX no community references CF Radar scan completed URLScan capture stored report URLScan verdict verdict unavailable DNS blocks not checked TLS valid certificate, 87d WHOIS 2d old Screenshot 4 captures · 4 sources Redirect chain not probed Gridinsoft 0/100

Network Security Intelligence Registrar Integrity Alert

Threat Detection Systems 1 alert

Detection System	Indicator	Verdict	Alert
DNS4EU	`syncbitreasury.icu`	malicious	Sinkholed

High-Risk Registrar NiceNIC

PhishDestroy audit found that over 90% of domains registered through NiceNIC are associated with illegal content. This registrar systematically ignores abuse reports and its primary clientele consists of CIS-region scam operators. We have not identified a single legitimate project hosted on this registrar.

NiceNIC Verdict Full Investigation

Threat Response Pipeline

Discovery

Checks

Reports

Availability

10/11

Sent Report Recorded

Stored sent-report record for registrar NICENIC INTERNATIONAL GROUP CO., LIMITED, hosting provider, 1 abuse contact

abuse@nicenic.net

Aug 7, 2026

Public Blocklist Status

Stored Capture

Screenshot of syncbitreasury.icu — **Primary capture**2026-08-07 13:35 UTC 1 / 4

View Full Size Wayback Download

TLS Certificate

Valid transport encryption · Issued by Google Trust Services · valid for 87 days

Domain Intelligence

Domain

Server / ASN cloudflare · AS13335 Cloudflare, Inc.

IP Context Cloudflare shared edge origin IP hidden Edge-IP reputation is not attributed to this domain.

Registrar NiceNIC

(RU) PhishDestroy Investigation

Abuse contactabuse@nicenic.net

ICANN RegistryOfficial ICANN accredited-registrars →

WHOIS LookupICANN RDAP for syncbitreasury.icu →

IP Address 188.114.97.3 CDN

Geo

Toronto, CA

NetworkAS13335 · CloudFlare, Inc.

Reverse IPviewdns.info → rapiddns.io →

The origin IP is hidden behind a CDN proxy. Reverse-IP results for the edge address contain unrelated tenants; finding the origin requires passive DNS or certificate-transparency data.

RegistrationCreated Aug 5, 2026 (2d · Brand New!) — Expires Aug 5, 2027

Technical detailsDNS, SSL SANs, timestamps

First DetectedAug 7, 2026

DOM Analysisanalyzed Aug 7, 2026score 73/100

Submitted URLhttps://syncbitreasury.icu/

Nameserverslamar.ns.cloudflare.comsima.ns.cloudflare.com

TLS Fingerprint

TLS Observationvalid from Aug 5, 2026scanned Aug 7, 2026

Case ID

SHORTDOT ZONE · PUBLIC EVIDENCE .icu

Built for Abuse. Sold Back as Protection.

Our evidence archive tracks every registered domain across all seven ShortDot zones. It estimates roughly $12.6 million a year in wholesale registry revenue and has found zero verified legitimate businesses to date. Our assessment: these zones function almost exclusively as disposable abuse infrastructure, while companies in the same commercial orbit sell brands protection from the resulting garbage. ShortDot gets the revenue; the internet gets the landfill.

ShortDot SA · Luxembourg 7 zones · full-zone evidence updated daily Open the ShortDot evidence repository

ICANN OVERSIGHT

Accreditation and RAA context

ICANN Got Paid. Accountability Did Not Arrive.

For this gTLD, the registrar above operates under an ICANN contract. ICANN collects annual, variable and transaction-based fees tied to registrations, renewals and transfers.

Accreditation: monetized. Accountability: please check back later.

Then the magic starts: ICANN writes RAA §3.18, the registrar investigates abuse inside its own customer base, and victims deliver the evidence for free while every layer waits for someone else to act. If that makes victims feel safer, excellent—the invoice worked.

Accreditation is a contract, not a safety seal. Verify ICANN fees Read RAA §3.18 PHISHDESTROY INVESTIGATIONThe ICANN Cartel: $155M for Broken Contracts

Satirical accountability note Nothing is sent automatically.

Technologies · 2 identified

Cloudflare

CDN

Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.

www.cloudflare.com 100% confidence

HTTP/3

Miscellaneous

HTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.

httpwg.org 100% confidence

Detected via Cloudflare Radar · Wappalyzer engine

Report This Domain Submit evidence & help protect others

Site Performance Analysis

Google PageSpeed Insights — mobile performance audit of syncbitreasury.icu · checked Aug 7, 2026

Good

Performance

FCP

0.77s

First Contentful Paint

LCP

2.55s

Largest Contentful Paint

CLS

0.002

Cumulative Layout Shift

TBT

335ms

Total Blocking Time

1.32s

Speed Index

Evidence & External Reports

Security Analysis

URLScan Stored capture VirusTotal ChainPatrol URLQuery 1 threat alert Gridinsoft 0 trust SSL Labs Stored TLS valid CF Radar Open report WOT ScamAdviser Blacklist Checker URLVoid Sucuri SiteCheck MDN Observatory

OSINT & Intelligence

Web-Check Full scan Shodan Censys ThreatFox Hudson Rock Sign-in search IntelX crt.sh Certs WHOIS Wayback

DNS & Network

nslookup.io DNS bgp.tools ASN/Route

SEO & Domain

SpyFu Moz DA/PA Ahrefs Backlinks Deep Analysis

Were You Affected by This Site?

If credentials were compromised, report immediately. Do not engage with recovery scammers.

If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.

FBI IC3

Report internet-enabled crime in the United States

Federal tips line1-800-CALL-FBI

Europol

Find the official reporting channel for your EU country

National police directory

Action Fraud

Report fraud and cybercrime in England, Wales and Northern Ireland

Contact centre0300 123 2040

PhishDestroy listing review Not a law-enforcement report

Domain Appeal

Request a review if you own this domain and believe the listing is incorrect

Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →

Report to Your Local Authorities

Select your country to get official cybercrime contacts, or create a complaint draft →.

97-country directory

Template-based draft • optional AI wording assistance requires separate consent Review and submit it yourself

Stay Informed, Stay Safe

Monitor live threats or contest this listing if you believe it's a false positive

Live Threat Feed Appeal This Listing

HTML · IFRAME

Embed This Report

Share this threat intelligence on your website or blog

embed.html

<iframe
  src="https://phishdestroy.io/embed/domain/syncbitreasury.icu"
  title="PhishDestroy threat report for syncbitreasury.icu"
  width="100%" height="320"
  loading="lazy"
  referrerpolicy="no-referrer"
  sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"
  style="border:0;border-radius:12px;max-width:100%"
></iframe>

syncbitreasury[.]icu

Threat Response Pipeline

Public Blocklist Status

Stored Capture

Domain Intelligence