app[.]synthra[.]org

This domain, app.synthra.org, is actively flagged as a high-risk credential phishing site targeting users under the guise of a trading platform. Analysis indicates the domain was registered on March 17, 2025, through a widely used registrar, and currently resolves to the IP address 172.67.141.65. The infrastructure is protected by Cloudflare, a common tactic to obscure hosting details and evade takedown efforts. The site presents itself with the page title 'Synthra | Trade with confidence,' suggesting an attempt to impersonate a legitimate financial or trading service, though no specific brand confirmation is available from the provided data. Security vendors have detected malicious activity associated with this domain, with seven out of ninety-five engines on a major threat intelligence platform flagging it as malicious. The domain appears on two security blocklists and is explicitly blocked by at least two threat intelligence feeds. A trust score of 0/100 from Gridinsoft and 1/100 from Scamadviser further corroborates its classification as a high-risk entity. The SSL certificate, issued by Google Trust Services, does not mitigate the threat, as phishing sites frequently use valid certificates to appear legitimate. While the domain’s exact content and phishing kit remain unverified, the combination of its recent registration, Cloudflare usage, and consistent detection by security tools strongly suggests it is part of an active credential harvesting operation. Defenders should treat this domain as hostile and prioritize blocking it at the network and endpoint levels. Monitoring for connections to 172.67.141.65 or related domains registered through the same registrar may help identify additional compromised infrastructure. Given its persistence as of July 12, 2026, immediate action is recommended to prevent user exposure.