zksync-blog-git-video-update-matter-labs-651a8986[.]vercel[.]app

This domain, zksync-blog-git-video-update-matter-labs-651a8986.vercel.app, poses a high-risk brand impersonation threat targeting users of the Across protocol. Analysis indicates the site mimics Across, a cross-chain bridging platform, by presenting itself under the guise of ZKsync updates. The page title, 'ZKsync: The Elastic Network,' is designed to deceive users into believing the content is affiliated with legitimate ZKsync or Across infrastructure, potentially leading to credential theft, unauthorized transactions, or malware distribution. The domain is structured to appear as a legitimate blog or update portal, leveraging social engineering tactics to exploit trust in established blockchain brands. Infrastructure analysis reveals multiple red flags supporting the malicious classification. The domain was registered through Tucows Domains Inc. on February 21, 2026, an anomalous creation date that predates the current year, suggesting potential domain spoofing or registry manipulation. It resolves to the IP address 216.198.79.3, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The domain appears on one security blocklist and is flagged as phishing by Google Safe Browsing. VirusTotal reports 11 out of 95 security vendors detecting the domain as malicious, with detections spanning phishing, brand impersonation, and potentially unwanted application categories. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the risk, as legitimate certificates are commonly abused in phishing campaigns to lend false credibility. Users who have visited zksync-blog-git-video-update-matter-labs-651a8986.vercel.app should take immediate remedial action. Disconnect any active sessions with the domain and revoke permissions granted to connected wallets or applications. Conduct a full scan of the device using updated security tools to detect potential malware or unauthorized scripts. If credentials or private keys were entered, rotate them immediately and monitor associated accounts for unauthorized activity. Report the domain to relevant security teams or blocklist providers to aid in broader mitigation efforts. Exercise heightened caution with communications or updates claiming to originate from Across or ZKsync, verifying authenticity through official channels before engaging.