syncetrust[.]support

The domain syncetrust.support was registered on 21 February 2026 and is presently taken offline. DNS resolution points to the IPv4 address 186.2.166.73, which is assigned to AS59692 operated by IQWeb FZ-LLC in the United Arab Emirates. The site presented a TLS certificate identified as 'R11', but no further certificate details such as issuer or validity period were disclosed. The page title returned by the host was 'Wallet Verification', matching the declared scam type of a crypto‑related fraud that impersonates Coinbase.

Gridinsoft’s trust scoring system assigned a rating of 0 out of 100, indicating a malicious reputation. Four independent blocklist providers—PhishDestroy, Polkadot, Enkrypt, and Codeesura—have listed the domain, confirming its inclusion in threat‑sharing feeds. VirusTotal analysis shows that five of ninety‑three scanning engines flagged the domain, reinforcing the malicious assessment despite the relatively low detection count. The combination of a newly created domain, low‑trust SSL, hostile IP attribution, and presence on multiple blocklists suggests a deliberate attempt to harvest Coinbase credentials or lure victims into sending cryptocurrency.

Uncertainty remains regarding the exact phishing kit used and whether any command‑and‑control infrastructure was associated with the host before takedown. Defenders should continue to block the hostname at DNS and proxy layers, monitor for outbound connections to 186.2.166.73, and add the domain to internal black‑lists. Email security gateways should be updated to flag any messages containing the 'Wallet Verification' subject line or links to this domain. Incident response teams ought to review recent logs for interactions with the IP address and consider user awareness campaigns focused on Coinbase‑related social engineering attempts.