synthetlx[.]at

This domain is flagged as a high-risk phishing threat targeting users of decentralized finance (DeFi) services. Analysis indicates synthetlx.at impersonates a legitimate cryptocurrency platform, likely Synthetix, to deceive victims into disclosing wallet credentials or transferring digital assets under false pretenses. The domain exhibits characteristics consistent with credential harvesting and financial fraud, including the use of lookalike branding and deceptive transaction prompts commonly associated with DeFi scams. Infrastructure analysis reveals synthetlx.at resolves to the IP address 185.53.179.136, an indicator previously linked to malicious campaigns. The domain appears on four security blocklists and is referenced in two AlienVault OTX threat intelligence pulses, suggesting active tracking by the cybersecurity community. Detection metrics include 11/95 security vendors on VirusTotal flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain was registered through Hosting Concepts B.V. (Registrar.eu), a registrar frequently observed in phishing operations. Additional defensive measures include blocking by MetaMask, PhishDestroy, SEAL, and Maltrail, further corroborating its malicious classification. Mitigation requires immediate action from both end users and network administrators. Users who interacted with synthetlx.at should revoke any connected wallet permissions, transfer assets to a new secure wallet, and monitor for unauthorized transactions. Network-level protections should include DNS filtering to block resolution of the domain and its associated IP, as well as implementing indicators of compromise (IOCs) such as 185.53.179.136 in intrusion detection systems. Organizations should educate users on identifying DeFi phishing tactics, particularly the use of lookalike domains and unsolicited transaction requests. Given the domain's current offline status, vigilance is advised for potential reemergence under alternative infrastructure.