sybilscan[.]xyz

Analysis indicates that sybilscan.xyz is an active phishing domain registered on May 11, 2026, through Name.com, Inc. The domain resolves to IP address 216.150.16.129, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. Its nameservers, ns1.vercel-dns.com and ns2.vercel-dns.com, suggest deployment on a platform commonly used for rapid front-end hosting. The page title, 'SybilScan — Sybil-proof your launch,' implies a fraudulent service targeting users seeking Sybil-resistant mechanisms, though the exact content and functionality remain unconfirmed as no direct inspection of the site has been conducted. Infrastructure reveals the use of a Let's Encrypt SSL certificate (R13) and HTTP Strict Transport Security (HSTS), which may lend superficial legitimacy. Detection data is limited: two of ninety-one security vendors on VirusTotal flagged the domain as malicious, and it appears on one security blocklist. The domain remains operational as of July 12, 2026, returning an HTTP 200 status. No evidence links this domain to a known phishing kit or specific brand impersonation beyond the thematic reference in its title. Defenders should treat sybilscan.xyz as high-risk due to its recent registration, active status, and association with phishing indicators. Network-level blocking and monitoring of the IP and domain are recommended. Further analysis of the site’s content and backend infrastructure could clarify the exact nature of the threat, but current evidence supports immediate containment measures.