# PhishDestroy domain threat record: zkdarkpool.vip

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/zkdarkpool.vip/
Machine-readable companion: https://phishdestroy.io/domain/zkdarkpool.vip/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-09 15:51:36 UTC
- Last availability or vendor check: 2026-10-22 10:34:14 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.132.114
- Registrar in stored WHOIS data: Namemart Limited
- Registrar country in stored WHOIS data: CN
- Last stored HTTP status: 200
- Registration date (registry RDAP, zkdarkpool.vip): 2025-12-12 12:23:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a115ae-b41b-75f9-b777-6df383a67fc8/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/zkdarkpool.vip
- Certificate Transparency search: https://crt.sh/?q=%25.zkdarkpool.vip
- Web Archive lookup: https://web.archive.org/web/*/https://zkdarkpool.vip/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
zkdarkpool.vip is an impersonation phishing page built around the idea of a privacy-focused "zk dark pool," a pitch aimed at DeFi traders looking for private, zero-knowledge order matching. PhishDestroy first flagged it on 2026-10-09. As of 2026-10-19 the site was still online and serving its content, so it remains a live risk to anyone who lands on it.

How the scam works
Impersonation pages like this copy the look and language of a legitimate crypto project so visitors trust it enough to connect a wallet, sign transactions or hand over recovery phrases. A single malicious signature or token approval can let the operator move funds out of the wallet, and a typed-in seed phrase gives away the whole wallet. The page title is "编组 21" (Chinese for "Group 21"), a generic layer name from a design tool rather than any brand name, while we classify the site as impersonation phishing.

Evidence
On 2026-10-13, 6 of 92 VirusTotal engines flagged the domain: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, LevelBlue and SOCRadar. That is a modest count, so many security tools will still let the page through. The wallet-focused blocklists are stronger evidence: MetaMask and SEAL both list the domain alongside PhishDestroy, which means MetaMask users should see a warning before the page loads. The domain also appears in two AlienVault OTX threat pulses.

Infrastructure
The domain was registered on 2025-12-12 through Namemart Limited, almost ten months before PhishDestroy detected it. That gap suggests the domain was held in reserve or ran quietly before drawing attention. It sits behind Cloudflare's network in the US, which hides the real origin server, and uses a Google Trust Services certificate. The padlock only means the connection is encrypted, not that the site is legitimate.

What to do
If you connected a wallet to zkdarkpool.vip, review and revoke any token approvals or permissions you granted there, and move remaining assets to a fresh wallet if you signed anything you did not fully understand. If you typed in a seed phrase or private key, treat that wallet as compromised and transfer funds to a new one immediately. Do not send further transactions or "fees" that the site asks for. Defenders should block the domain at DNS and proxy level, add it to wallet and browser protection lists, and report it to Cloudflare and Namemart Limited so the live page can be taken down.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a115ae-b41b-75f9-b777-6df383a67fc8/
VirusTotal report: https://www.virustotal.com/gui/domain/zkdarkpool.vip
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=zkdarkpool.vip
Archived copy: https://web.archive.org/web/20261009160354/https://zkdarkpool.vip/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:28:12 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a115ae-b41b-75f9-b777-6df383a67fc8.png
  Captured: 2026-10-09 15:51:36 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a115ae-b41b-75f9-b777-6df383a67fc8.png
  Captured: 2026-10-10 03:30:09 UTC
  Source report: https://urlscan.io/result/01a115ae-b41b-75f9-b777-6df383a67fc8/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e99401ab-9836-486a-a8e8-93b22b8bf10a.png
  Captured: 2026-10-09 16:26:33 UTC
  Source report: https://radar.cloudflare.com/scan/e99401ab-9836-486a-a8e8-93b22b8bf10a
  SHA-256: ecf0f7ec7d8a18f78817aba5cd1545b0c6d56e7bed5fa5344deb596fbf09f6c8
- URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a12175-35ee-77b1-9bef-38abb69234f1.png
  Captured: 2026-10-09 16:18:20 UTC
  Source report: https://urlscan.io/result/01a12175-35ee-77b1-9bef-38abb69234f1/
  SHA-256: be39fb07bfe047f2373be3157de98c2554812ee9947eab6565ead76cde52a5ca
- URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a12177-0ab9-7348-942a-6fdac7564e64.png
  Captured: 2026-10-09 16:20:22 UTC
  Source report: https://urlscan.io/result/01a12177-0ab9-7348-942a-6fdac7564e64/
  SHA-256: a57216dd63a0fddd3e5d7ab7e6795dd2c2ced15645ebdb17e5273776e5997e5b
- URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a12187-58c0-742b-9428-05b0f03e70fe.png
  Captured: 2026-10-09 16:38:10 UTC
  Source report: https://urlscan.io/result/01a12187-58c0-742b-9428-05b0f03e70fe/
  SHA-256: b3ed09f3e542bfa824f8ec052b3d4695e4daea0abb161d8f2dd2bf0b4d3d0495
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a149ad-86cd-756b-b1e5-12103944bfdd.png
  Captured: 2026-10-17 11:44:42 UTC
  Source report: https://urlscan.io/result/01a149ad-86cd-756b-b1e5-12103944bfdd/
  SHA-256: 8fadc80d40ecc359988991a7ca0a66c396cfb1d579ab48ab55bb704859438cb7
- URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a157da-742a-7301-8526-3c8f59aee150.png
  Captured: 2026-10-20 05:48:26 UTC
  Source report: https://urlscan.io/result/01a157da-742a-7301-8526-3c8f59aee150/
  SHA-256: 321b2cb38f053bdd3b212fca1e3972a06785c9c48849752969a26a92fcc420a1
- URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a157f2-54b3-73db-9bd4-889b3008eda6.png
  Captured: 2026-10-20 06:14:30 UTC
  Source report: https://urlscan.io/result/01a157f2-54b3-73db-9bd4-889b3008eda6/
  SHA-256: c3e6c7efdeb572aa4857b588cddd43f9628bf2b5640c51e5256aaa1204f03746

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:36:40Z",
        "uuid": "01a115ae-b41b-75f9-b777-6df383a67fc8",
        "scanned_at": "2026-10-07T09:25:42Z",
        "final_url": "https://zkdarkpool.vip/",
        "status": 200,
        "ip": "172.67.132.114",
        "domains": [
            "kf.dl237x.com",
            "ooudessd.oss-ap-southeast-1.aliyuncs.com"
        ],
        "ips": [
            "47.79.48.159",
            "8.212.161.30",
            "172.67.132.114"
        ],
        "asns": [
            "45102",
            "13335"
        ],
        "countries": [
            "SG",
            "PH"
        ],
        "doc_hash": "ad9a80bf23504ad489eacdafaaac565505abf285ac396a954f8c2959f564bd8c",
        "script_hashes": [
            "cb0c6c9f1771d252eee7caa043bdd7cfffbd52c2cc4b18b7be7c4554ed069151",
            "40c30aa1cb95a456c67432838365efa2851da18dc9d8ec931d466aea8e24b9e1",
            "3904b25aa15a4303ab011fed504bff10853457942b3c23f4121c8b2889e4a077",
            "d2a6ea9e87c1ebf8c0a194fe7e0d80b445bf47edbc787c25e5bf9352ea34747f",
            "4bb9d8f31865892b9f49ce99adc3d6ebe192159a6598951d6239f86ac18fa3d5",
            "b97a6572dc84720b4b34b74c9235a7a00a9080998be8c9f9037175f0cf5ebedf",
            "4699b2fed3971cb880e458e5a6d9d72182ab200f6ce97653656686d0c3e6225f"
        ],
        "globals": [
            "TradingView",
            "addLink",
            "addMeta",
            "lib",
            "rem",
            "dpr",
            "__VUE_INSTANCE_SETTERS__",
            "__VUE_SSR_SETTERS__",
            "__INTLIFY_PROD_DEVTOOLS__",
            "__INTLIFY_JIT_COMPILATION__",
            "__INTLIFY_DROP_MESSAGE_COMPILER__",
            "__VUE_I18N_FULL_INSTALL__",
            "__VUE_I18N_LEGACY_API__",
            "setImmediate",
            "clearImmediate",
            "PubSub",
            "__config",
            "__theme",
            "__VUE__",
            "__vite_is_modern_browser",
            "chatwootSDK",
            "chatwootSettings",
            "$chatwoot"
        ],
        "cookies": [
            "p_uv_id"
        ],
        "storage_keys": [
            "linch_THEME",
            "main",
            "linch_LANGUAGE"
        ],
        "tls": {
            "san": [
                "zkdarkpool.vip",
                "*.zkdarkpool.vip"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "zkdarkpool.vip",
            "protocol": "QUIC",
            "valid_to": "2027-01-02T17:29:47Z",
            "valid_from": "2026-10-04T16:32:08Z"
        },
        "domain_age_days": 298,
        "apex_age_days": 298,
        "tls_age_days": 2,
        "tls_valid_days": 90,
        "requests": 101,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:46:43Z",
        "uuid": "e99401ab-9836-486a-a8e8-93b22b8bf10a",
        "scanned_at": "2026-10-09T16:26:33Z",
        "final_url": "https://zkdarkpool.vip/",
        "status": 200,
        "history": [
            {
                "url": "https://zkdarkpool.vip/",
                "status": 200
            }
        ],
        "dom_hash": "c6a92ec8ce83a2052470f53f9769427d97352493d0114a6e8af74121a91340fa",
        "doc_hash": "90bef3d51d807d7e3af11169b023c0533571baac1b2368bb58a61ba619baaf92",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "zkdarkpool.vip",
                "type": "A",
                "value": "172.67.132.114"
            },
            {
                "name": "zkdarkpool.vip",
                "type": "A",
                "value": "104.21.4.209"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.132.114",
        "whois": {
            "registrar": "Namemart Limited",
            "created": "2025-12-12T12:23:00Z",
            "updated": "2026-02-10T12:23:04Z",
            "expires": "2026-12-12T12:23:00Z",
            "nameservers": [
                "venkat.ns.cloudflare.com",
                "lia.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T04:05:10Z",
        "analysis_at": "2026-10-13T02:00:13Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 1,
            "undetected": 36
        },
        "detections": {
            "alphaMountain.ai": "suspicious"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Suspicious (alphaMountain.ai)"
        },
        "created": "2025-12-12T00:00:00Z",
        "updated": "2025-12-12T00:00:00Z",
        "first_seen": "2025-12-12T14:34:32Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.132.114"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.4.209"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "lia.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "lia.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "venkat.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-13T02:00:35Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "zkdarkpool.vip",
                "*.zkdarkpool.vip"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "ae48f79ae42048af0eda373b1b537cf3",
            "sha256": "c1bece821595c0d8b4785a0a3bcec703b75df8af716b4580ae94518a3573fec0",
            "subject": "zkdarkpool.vip",
            "valid_to": "2027-01-02T17:29:47Z",
            "valid_from": "2026-10-04T16:32:08Z"
        },
        "whois": [],
        "rdap": {
            "status": [
                "serverTransferProhibited"
            ],
            "events": {
                "registration": "2025-12-12T12:23:00Z",
                "registrar expiration": "2026-12-12T12:23:00Z",
                "last update of RDAP database": "2025-12-12T22:17:01Z"
            },
            "registrar": "Namemart Limited",
            "registrar_iana_id": "3863"
        }
    }
}
```