synchronizernodefix[.]pages[.]dev

Analysis indicates that the domain synchronizernodefix.pages.dev was registered on February 21 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.47.3, which is associated with ASN 13335 in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 identifier, confirming that the site uses a valid HTTPS certificate despite its malicious purpose. The page title returned by the server is “React App”, and the underlying stack includes Bootstrap, HSTS, cdnjs, Popper and HTTP/3, all delivered via Cloudflare’s CDN. The site returned an HTTP 403 status code at the time of observation, and its current operational status is listed as offline. Threat intelligence classifies the site as a “Fake Airdrop” campaign that impersonates the brand “across”.

Seven of ninety‑five security vendors on VirusTotal flagged the domain, and four independent blocklists – PhishDestroy, MetaMask, ScamSniffer and SEAL – have already listed it. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of high malicious intent. No additional content analysis is available because the site is taken offline, so the exact phishing page or payload cannot be confirmed. Defenders should immediately add synchronizernodefix.pages.dev to network deny lists and DNS sinkhole rules, as the domain is already identified by multiple reputable blocklists. Monitoring for any future re‑hosting on the same IP address or within the same Cloudflare account is advisable, given the ease of redeployment on the same infrastructure.

Because the TLS certificate is valid, standard TLS inspection or certificate pinning may be required to detect traffic to this domain. Organizations that enforce brand‑specific allowlists for “across” should ensure that any request to this domain is blocked, even if the certificate appears legitimate.