zksync[.]airdropsalert[.]life

Analysis of the domain zksync.airdropsalert.life, observed on July 23 2026, indicates a crypto‑related brand‑impersonation campaign targeting users of the zkSync platform. The site was served without an SSL certificate and returned the page title “Google”, which does not correspond to the advertised brand and suggests a placeholder or misconfiguration rather than a genuine imitation of zkSync’s interface. VirusTotal recorded 14 detections out of 95 scanned vendors, confirming that multiple security engines classify the host as malicious. The domain is registered through Cloudflare, Inc., but its authoritative nameserver records could not be retrieved (NS_NOT_FOUND), limiting attribution of the underlying registrar details.

Network resolution points to the IPv6 address 2a00:1450:4001:813::2004, which belongs to the AS15169 Google LLC network and resolves to a location in Germany. The same IP address is also associated with legitimate Google services, indicating that the attacker is leveraging a shared hosting environment or abusing a legitimate cloud provider to hide malicious activity. The domain appears on one known security blocklist and is listed as blocked by the PhishDestroy service, reinforcing the malicious assessment. The current operational state is offline, suggesting the infrastructure has been taken down or is temporarily dormant.

However, the combination of brand impersonation, confirmed detections, and the use of a reputable hosting provider warrants continued monitoring. Defenders should add the domain and its IPv6 host to blocklists, enforce TLS inspection for outbound connections to the address, and watch for re‑registration attempts that may reuse the same content or hosting. Incident response teams should also consider updating email and web filtering rules to flag any communications that reference “zkSync” in conjunction with URLs matching the pattern *.airdropsalert.life.