users-zksync[.]xyz

The domain users-zksync.xyz poses a significant threat as it impersonates zkSync, a well-known brand, potentially misleading users into divulging sensitive information or performing unauthorized transactions. This domain is categorized under brand impersonation, which involves creating a deceptive online presence to mimic legitimate entities.

Analysis indicates that users-zksync.xyz was created on April 14, 2026, and is registered through Dynadot LLC. The domain has been flagged by 8 out of 95 security vendors on VirusTotal, a platform used for detecting malicious URLs, files, and IP addresses. Additionally, it appears on 3 security blocklists, further confirming its malicious nature. The SSL certificate is issued by Let's Encrypt and identified by the serial number E8, which is a common practice for legitimate sites but does not guarantee security. The domain resolves to the IP address 172.67.138.6, which is located in California and is associated with Cloudflare, Inc. These technical indicators, combined with the domain's current offline status, suggest a deliberate attempt to deceive users.

If a user has visited users-zksync.xyz, they should immediately check their accounts for any unauthorized activity and consider changing their passwords. It is also recommended to review any personal or financial information that may have been entered on the site. Users should report the incident to their security team or service provider and avoid clicking on any links or downloading files from this domain in the future. Staying informed about known brand impersonation tactics and regularly updating security software can help mitigate the risk of such threats.