zksynclabs[.]com

On July 22, 2026, the domain zksynclabs.com was identified as a phishing campaign engaged in brand impersonation, specifically targeting the zkSync brand. The domain was registered through GMO Internet, Inc. and created on August 21, 2025. It was observed to resolve to the IP address 52.40.42.113, which is located in the United States and is part of the AS16509 network operated by Amazon.com, Inc. The website had an HTTP status of 200, indicating that it was accessible at the time of the last check, although it is currently offline. The page title of the site was noted as 'For Sale Page', which may suggest that the domain was being offered for sale; however, the exact content and intent of the page have not been fully analyzed.

Infrastructure analysis reveals the use of Nginx and OpenResty web server technologies, and the domain is protected with an HSTS policy, which could be an attempt to enhance credibility. The SSL certificate is issued by Let's Encrypt, a trusted certificate authority, but this does not necessarily indicate the site's legitimacy. Security vendors PhishDestroy, ScamSniffer, and Enkrypt have flagged this domain as malicious, and it appears on three security blocklists.

The Gridinsoft trust score for zksynclabs.com is 0/100, indicating a significant level of distrust. Defenders and security teams should be vigilant and monitor for any attempts to revive the domain or similar impersonation campaigns. End-users should avoid visiting the site and report any suspicious activity to their security contacts.