syntheticswap[.]io

Analysis of the domain syntheticswap.io indicates active brand impersonation targeting Synthetix, a decentralized finance protocol. The domain resolves to IP address 75.2.60.5 and is hosted on infrastructure associated with Netlify. The page title, 'SyntheticSwap — Private Crypto Exchange | No KYC,' suggests an attempt to mimic a legitimate cryptocurrency exchange service, though no direct visual confirmation of the site's content has been conducted. The domain is flagged by 15 of 95 security vendors on VirusTotal, with detections indicating malicious intent. It appears on four security blocklists and is referenced in 16 threat intelligence pulses on AlienVault OTX, further corroborating its association with phishing activity. The domain employs a Let's Encrypt SSL certificate, a common tactic among threat actors to lend an appearance of legitimacy. It is currently blocked by multiple security mechanisms, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. The Gridinsoft trust score for the domain is 0/100, reflecting a high-risk classification. Technologies detected include HSTS, which may be leveraged to enforce secure connections and evade certain detection methods. Defenders are advised to treat this domain as malicious and implement blocking measures at the network and endpoint levels. Given its active status and association with known threat intelligence, monitoring for related infrastructure or domains resolving to the same IP address may aid in identifying further compromise attempts. The exact nature of the phishing scheme—whether credential harvesting, crypto drainer, or other fraud—remains unconfirmed pending deeper analysis of the site's functionality.