syncswap-onchain[.]pages[.]dev

The domain syncswap-onchain.pages.dev was registered through Cloudflare, Inc. on February 21, 2026 and is currently taken offline. Technical analysis shows the site was served over HTTPS with HSTS enabled, leveraged Cloudflare’s HTTP/3 support, and presented a valid SSL certificate issued by Google Trust Services (WE1). DNS resolution points to the IP address 172.66.47.123, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. The authoritative name servers are summer.ns.cloudflare.com and jacob.ns.cloudflare.com. An HTTP request to the root URL returned a 403 status code, indicating access was deliberately denied, consistent with the reported offline state.

Brand targeting is identified as Discord, and the page title observed was "SyncSwap," suggesting the operator attempted to lure Discord users into a wallet or seed phishing campaign. The scam type is explicitly listed as Wallet/Seed Phishing. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis recorded five detections out of ninety‑three scanning engines, reinforcing the malicious classification. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of abuse.

While the page content has not been captured, the combination of brand impersonation, wallet‑seed targeting, and the presence of a valid SSL certificate issued by a trusted CA demonstrates a sophisticated attempt to gain user trust. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑hosting attempts, and update endpoint protection signatures to reflect the five VirusTotal detections. Threat intelligence feeds should be refreshed to include the domain’s identifiers (seed 1ce2bb) and its Cloudflare‑hosted IP range.