sync-chainnet[.]com

Analysis of sync-chainnet.com, first observed on February 21, 2026, shows an active infrastructure delivering a crypto‑related phishing campaign. The domain resolves to IP address 198.251.88.188, which is registered to AS53667 FranTech Solutions in the United States. Registration was performed through Global Domain Group LLC and the domain is delegated to four nameservers (ns7.asurahooming.com, ns7.my-control-panel.com, ns8.asurahosting.com, and an incomplete entry), indicating a multi‑provider DNS configuration. The site presents a page titled "WhoAmI? Discover Whoer AML in the Web3 Jungle!" and serves content over HTTPS using a Let’s Encrypt R12 certificate, confirming the presence of a valid TLS layer.

HTTP responses return status code 200, and the web server identifies as LiteSpeed with HTTP/3 support, suggesting a modern hosting environment. MX records are present but point to the same domain, a pattern often used to bypass simple email validation checks. Security telemetry flags the domain on four blocklists and records detections from PhishDestroy, MetaMask, ScamSniffer, and SEAL. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

VirusTotal reports three positive detections out of ninety‑three scanners, providing independent confirmation of malicious activity. Although the exact phishing landing page layout is not disclosed, the available evidence—cryptocurrency focus, hostile hosting, low trust score, and multiple vendor blocks—supports a high‑risk classification. Defenders should block the domain at network perimeters, update URL filtering lists, and monitor for connections to 198.251.88.188. Additional investigation is warranted to capture payloads, observe credential capture attempts, and determine any downstream command‑and‑control infrastructure.