zkveriify[.]xyz

Analysis of the domain zkveriify.xyz indicates it was established as a phishing infrastructure on September 30, 2025, registered through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolved to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335) in the United States. At the time of assessment, no SSL certificate was present, and the domain displayed a page titled 'Just a moment...', a response commonly associated with Cloudflare's interstitial or challenge pages, which may have been used to obscure malicious content or filter visitor traffic. Security vendors PhishDestroy and ScamSniffer have flagged this domain, and it appears on two independent security blocklists.

AlienVault OTX records the domain in one threat intelligence pulse, suggesting prior detection in operational security monitoring. Gridinsoft assigns a trust score of 0 out of 100, reflecting high suspicion. While eight of 95 security vendors on VirusTotal detected the domain as malicious, the absence of additional context—such as brand impersonation, phishing kit signatures, or targeted sectors—limits further classification beyond generic phishing activity. Nameservers cesar.ns.cloudflare.com and shubhi.ns.cloudflare.com were in use, consistent with Cloudflare's DNS infrastructure.

The domain has since been taken offline, though historical resolution and detection data remain relevant for retrospective threat hunting. Defenders are advised to review logs for connections to 188.114.97.3 and the domain itself, particularly in contexts involving user verification workflows or credential submission. No specific brand or service impersonation has been confirmed based on available evidence, and the exact content served by the site prior to takedown is not yet analysed.