syncestrust[.]site

Analysis of syncestrust.site indicates a brand‑impersonation campaign targeting Coinbase users. The domain was registered on February 21, 2026 and resolves to the IP address 186.2.166.73, which is hosted in the United Arab Emirates under ASN 59692 (IQWeb FZ‑LLC). The site presented a page titled "Wallet Verification," a common lure for cryptocurrency credential harvesting. VirusTotal recorded a single detection out of 93 scanning engines, confirming that at least one security vendor identified malicious intent.

Gridinsoft assigned a trust score of 0 out of 100, and the SSL certificate received a low R10 rating, both indicating poor security posture. The domain appears on four reputable blocklists and has been actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, reinforcing the consensus that it is being used for a crypto scam. Current observations show the site is taken offline, which may be temporary or a tactic to evade detection.

Defenders should continue to enforce blocklist rules that include syncestrust.site, monitor traffic to the associated IP range for any residual malicious activity, and ensure that endpoint protection solutions are updated to reflect the single VirusTotal detection. Organizations should educate users about unsolicited Coinbase‑related verification requests and advise verification only through official Coinbase channels. Incident response teams should treat any credential submissions to this domain as compromised and initiate appropriate credential rotation and account monitoring procedures.