synthr-register[.]pages[.]dev

PhishDestroy identifies synthr-register.pages.dev as a fake registration portal impersonating the Synthr platform. This domain employs a crypto drainer kit hosted on Cloudflare Pages, delivering malicious scripts designed to siphon funds from connected wallets upon user interaction. The threat is currently active and under forensic evaluation to determine the full scope of exfiltration tactics and compromised assets.

Exact technical indicators reveal a VirusTotal detection score of 4/95, indicating no initial antivirus flags despite active malicious hosting. The domain resolves to IP 188.114.97.3 via Cloudflare, Inc. registration, and possesses a Google Trust Services SSL certificate. It has been flagged by ScamSniffer and Enkrypt and appears on 2 external blocklists, suggesting early but confirmed malicious reputation. The domain was likely created recently given its Cloudflare Pages hosting structure and lack of historical data.

The domain is currently marked as active with a status of under_investigation and a risk level of under_investigation. Security vendors have begun blocking traffic, and user reports are being analyzed to enhance detection. Remaining risk is moderate due to undetected malware signatures and active hosting on a trusted CDN. Users are advised to avoid interaction and verify any Synthr-related links using PhishDestroy before sharing wallet credentials or private keys.