zksync-enterprise-pxn6m30gh-matter-labs-651a8986[.]vercel[.]app

This domain, zksync-enterprise-pxn6m30gh-matter-labs-651a8986.vercel.app, is identified as a high-risk brand impersonation threat targeting zkSync, a cryptocurrency scaling protocol. The page title, "ZKsync.io," directly mimics the legitimate zkSync domain, suggesting an intent to deceive users into interacting with fraudulent content. No explicit crypto drainer kit signatures were detected in initial scans, but the domain structure and branding alignment indicate a likely phishing or credential harvesting operation. Analysis reveals the following technical indicators: the domain is flagged by 14 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly labeling it as phishing. It is registered through Vercel Inc. and resolves to the IP address 64.29.17.195, hosted on Amazon.com, Inc. infrastructure (AS16509). The domain appears on one security blocklist (PhishDestroy) and uses an SSL certificate issued by Google Trust Services (WR1). No creation date was provided, but the active status and recent detections suggest recent registration or compromise. As of the latest assessment, the domain remains active and unmitigated, posing a continued risk to users. Immediate response actions should include blacklisting the domain across enterprise security tools, notifying the hosting provider (Vercel) for takedown, and monitoring for related infrastructure (e.g., subdomains, linked IPs). Users are advised to verify domain authenticity before interacting with zkSync-related sites, particularly those hosted on third-party platforms like Vercel. The remaining risk is classified as high due to the domain's active status and direct impersonation of a high-value cryptocurrency target.