app[.]synecdochedex[.]fun

PhishDestroy identifies app.synecdochedex.fun as an active crypto drainer phishing domain. The domain mimics Synecdoche Dex, a cryptocurrency trading platform, to deceive users into connecting malicious wallets. Threat actors leverage this domain to siphon cryptocurrency assets under the guise of legitimate transactions. The infrastructure relies on deceptive branding to exploit user trust in familiar crypto services. This domain was flagged with a VirusTotal detection score of 0/95, indicating no immediate antivirus or security vendor recognition as malicious. It was registered on January 19, 2026, through NAMECHEAP INC and resolves to the IP address 64.29.17.65. The domain utilizes a valid SSL certificate issued by Let's Encrypt, enhancing its appearance of legitimacy. As of the latest scan, the domain remains unlisted on Google Safe Browsing (GSB) and has not been added to major blocklists, suggesting a newly emerged or rapidly evolving threat. The domain is currently active and under investigation by PhishDestroy. No public blocklist entries or vendor detections have been recorded, leaving users vulnerable to exposure. Immediate actions include domain takedown requests to hosting providers and continued monitoring for additional IOCs. The remaining risk is classified as active but under investigation, with users advised to avoid interaction until further analysis is complete. PhishDestroy recommends verifying the safety of this domain using its threat intelligence database before any engagement.