app-synthetix[.]xyz

This domain, app-synthetix.xyz, is actively flagged as a high-risk brand impersonation targeting Synthetix, a known decentralized finance platform. Registered on April 14, 2026, through Dynadot LLC, the domain resolves to IP address 172.67.184.58, hosted under Cloudflare, Inc. in Canada. Infrastructure analysis reveals Cloudflare nameservers (alexa.ns.cloudflare.com and randall.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which are consistent with tactics used to obscure hosting origins and evade detection. The domain is currently blocked by three security blocklists, including PhishDestroy, MetaMask, and SEAL, and appears in one AlienVault OTX threat intelligence pulse. Gridinsoft assigns a trust score of 0/100, further indicating malicious intent. While the HTTP status returns a 403 error, the domain remains operational, suggesting potential intermittent availability or cloaking techniques to avoid automated scans. Defenders should note that the domain is explicitly categorized as an impersonation scam, though the exact content or functionality of the site has not been analyzed. Three of 94 security vendors on VirusTotal have flagged the domain, providing additional corroboration of its malicious nature. The combination of brand impersonation, low trust scores, and active blocklisting warrants immediate inclusion in threat intelligence feeds and network-level blocking. No evidence suggests compromise of legitimate Synthetix infrastructure, but the domain’s creation date and Cloudflare hosting align with patterns observed in recent phishing campaigns targeting cryptocurrency platforms. Organizations should monitor for related domains registered through Dynadot or resolving to the same IP range, as this may indicate a broader campaign.