zkmlrewardpool[.]xyz

This domain, zkmlrewardpool.xyz, is actively flagged as a high-risk phishing endpoint specializing in fake airdrop schemes. Registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to the IP address 104.21.1.219, hosted behind Cloudflare infrastructure in Canada. Analysis indicates that 7 out of 95 security vendors on VirusTotal have detected malicious activity associated with this domain, reinforcing its classification as a threat. The domain remains operational despite returning an HTTP 403 status, suggesting either a deliberate attempt to obscure its content or an active but restricted phishing page. Infrastructure analysis reveals the use of Cloudflare nameservers (emerie.ns.cloudflare.com and zahir.ns.cloudflare.com), a common tactic to mask the true hosting provider and complicate takedown efforts. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as legitimate certificates are frequently exploited to lend false credibility to phishing sites. The domain appears on at least one security blocklist and has been documented in eight threat intelligence pulses on AlienVault OTX, indicating broader awareness within the security community of its malicious intent. The specific scam type—fake airdrop—targets users expecting cryptocurrency rewards, a tactic that has seen increased prevalence in 2026. While the exact phishing kit or payload remains unconfirmed, the domain’s continued activity and its association with known phishing infrastructure warrant immediate defensive action. Defenders should prioritize blocking the domain and its resolved IP address at the network level, as well as monitoring for any attempts to access or interact with it. Given the domain’s recent registration and persistent activity, it is likely to remain a threat until disrupted or taken offline.