Domain security and threat intelligence

syncflrslinks.online

“Flare - EVM Hub for Web 3.0”

Threat verdict Critical 100/100 evidence score

Availability Content unavailable Content was unavailable in the latest observation

Risk signals

VirusTotal detections: 11/93 Stored blocklist matches: 4 Brand impersonation: Ethereum

Feb 26, 2026 Ethereum

Actions API

Evidence Summary

CRITICAL

The site syncflrslinks.online is a fraudulent cryptocurrency platform that impersonated the Ethereum brand. Its page title, "Flare - EVM Hub for Web 3.0," was used to present a fake Web3 infrastructure service designed to deceive users into connecting their cryptocurrency wallets or providing credentials. The primary threat is credential theft or cryptocurrency asset loss through a phishing scheme masquerading as a legitimate blockchain hub.

Technical analysis confirms the site is malicious. VirusTotal flagged it with 11 detections out of 95 security vendors. It was specifically flagged by alphaMountain.ai, BitDefender, CyRadar, Fortinet, and G-Data, and appeared on 5 blocklists. The domain was registered on 2026-02-21, hosted at IP address 195.20.18.201, which is associated with AS48753 AVA HOST SRL in Moldova (MD). The site used an R11 SSL certificate.

The domain is currently offline and down. Its DOM risk score is 80, indicating a high-risk profile. Based on the provided data, the threat is neutralized while the site is inactive, but the domain remains a potential risk if reactivated.

VirusTotal

11 det.

URLScan

Report ↗

TLS Certificate

Expired or unverified

Age

7 mo

Observed status

Content unavailable

DestroyList

Listed

Data coverage VirusTotal 11 / 93 URLQuery checked — no detections recorded OTX no community references URLScan capture stored report URLScan verdict malicious TLS Expired or unverified WHOIS 7 mo old Screenshot 3 captures · 3 sources

Threat Response Pipeline

Discovery

Checks

Reports

Availability

12/13

Public Blocklist Status

Detection-evasion analysis

Cloaking and traffic-distribution check

Not observed No cloaking was observed in the stored scan 2026-09-25 03:09:59 UTC

Stored crawler-versus-browser observations for this host, plus a live fingerprint check for Keitaro-style traffic distribution systems.

Stored cloaking flag: Not observed
Cloaking score: 0/6
Last cloaking scan: 2026-09-25 03:09:59 UTC

Scanner note: dns_error: raw=dns_error; via=local_dns_prefilter

Live TDS fingerprint check

Seven Keitaro fingerprints plus a crawler-versus-browser comparison, run from the PhishDestroy scanner when this panel is open.

Waiting

Stored Capture · 3 sources

Screenshot of syncflrslinks.online — **Primary capture**2026-02-26 22:23 UTC 1 / 3

SourcePrimary capture

Captured2026-02-26 22:23 UTC

StateStored capture

Position1 / 3

View Full Size Open raw image Wayback Download

Domain Intelligence

Domain

URLScan Verdict Malicious score 100 Phishing report ↗

Server / ASN nginx · AS48753 AVAHOHST AVA HOST SRL, MD

IP Reputation abuse score 0/100 1 report checked Jun 15, 2026

IP Address 195.20.18.201

Geo

Chisinau, MD

NetworkAS48753 · AVA HOST SRL

Reverse IPviewdns.info → rapiddns.io →

RegistrationCreated Feb 21, 2026 (217d)

Time to First Unavailability 40 days

What we count Elapsed time from the first stored abuse report to the first observation that the content was unavailable. This does not establish the cause.

What each report contains Stored outgoing-report records may reference evidence available at the time, such as vendor verdicts, registration data, hosting details, classifications, or screenshots. This page does not infer the exact payload delivered, receipt, acknowledgement, or action by a recipient.

Technical detailsDNS, SSL SANs, timestamps

First DetectedFeb 26, 2026

DOM Analysisanalyzed Mar 24, 2026score 80/1001 brand signal

IoC Extractionscanned Aug 1, 20260 wallet · 0 Telegram IoCs

Page Title

Flare - EVM Hub for Web 3.0

Impersonates

Ethereum

TLS Certificate

Expired or unverified · Issued by R11

Report This Domain Submit evidence & help protect others

VirusTotal Analysis

11 / 93 security vendors flagged this domain

View on VT

Last analyzed 2026-02-25 02:15:41 UTC

alphaMountain.ai

BitDefender

CyRadar

Fortinet

G-Data

Google Safebrowsing

Kaspersky

Lionic

Seclookup

Sophos

VIPRE

Lookalike domains

52 stored lookalike domains

ethercum.org homoglyph Internal report etheruem.org transposition Internal report athereum.org bitsquatting dethereum.org insertion e.thereum.org subdomain efhereum.org replacement ehereum.org omission etereum.org omission eth3reum.org replacement ether.eum.org subdomain etheream.org vowel-swap ethereim.org replacement

Show all (40)

ethereium.org insertion etherem.org omission etheremu.org transposition ethereom.org vowel-swap etheresum.org insertion ethereujm.org insertion ethereum2.org addition ethereum3.org addition ethereum4.org addition ethereumc.org addition ethereumd.org addition ethereumorg.com various ethereumr.org addition ethereums.org addition ethereumx.org addition ethereun.org homoglyph ethereunm.org homoglyph ethereurm.org homoglyph ethereurn.org homoglyph ethereuym.org insertion ethereuzm.org insertion ethereyum.org insertion etherium.org vowel-swap etherrum.org replacement etherteum.org insertion etherum.org omission ethezeum.org bitsquatting ethireum.org vowel-swap ethnereum.org insertion ethreum.org omission ethureum.org bitsquatting etihereum.org homoglyph ithereum.org vowel-swap othereum.org vowel-swap rethereum.org insertion sethereum.org insertion thereum.org omission uthereum.org bitsquatting zethereum.org insertion zthereum.org replacement

Community reports

Reported by 1 community member, first seen Aug 7, 2025

Stored reports: 1
Unique reported URLs: 1

Accepted1

Evidence & External Reports

Security Analysis

URLScan Malicious VirusTotal 11 det. ChainPatrol URLQuery Analyzed SSL Labs Expired/unverified WOT ScamAdviser Blacklist Checker URLVoid Sucuri SiteCheck MDN Observatory

OSINT & Intelligence

Web-Check Full scan SOCRadar Dark web report LeakIX Leak search Shodan Censys ThreatFox Hudson Rock Sign-in search IntelX crt.sh Certs WHOIS Wayback

DNS & Network

nslookup.io DNS bgp.tools ASN/Route

SEO & Domain

SpyFu Moz DA/PA Ahrefs Backlinks Deep Analysis

Were You Affected by This Site?

If credentials were compromised, report immediately. Do not engage with recovery scammers.

If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.

FBI IC3

Report internet-enabled crime in the United States

Federal tips line1-800-CALL-FBI

Europol

Find the official reporting channel for your EU country

National police directory

Action Fraud

Report fraud and cybercrime in England, Wales and Northern Ireland

Contact centre0300 123 2040

PhishDestroy listing review Not a law-enforcement report

Domain Appeal

Request a review if you own this domain and believe the listing is incorrect

Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →

Report to Your Local Authorities

Select your country to get official cybercrime contacts, or create a complaint draft →.

97-country directory

Template-based draft • optional AI wording assistance requires separate consent Review and submit it yourself

Stay Informed, Stay Safe

Monitor live threats or contest this listing if you believe it's a false positive

Live Threat Feed Appeal This Listing

HTML · IFRAME

Embed This Report

Share this threat intelligence on your website or blog

embed.html

<iframe
  src="https://phishdestroy.io/embed/domain/syncflrslinks.online"
  title="PhishDestroy threat report for syncflrslinks.online"
  width="100%" height="320"
  loading="lazy"
  referrerpolicy="no-referrer"
  sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"
  style="border:0;border-radius:12px;max-width:100%"
></iframe>