zksync[.]airdropsalert[.]us

Analysis of zksync.airdropsalert.us indicates a brand‑impersonation campaign targeting zkSync users. The domain was registered on 18 October 2025 through Dynadot LLC and resolves to the IP address 142.251.163.106, which belongs to Google LLC (AS15169) in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS services. No TLS certificate is presented, so connections are served over plain HTTP. The page title returned by the server is “Google”, which does not align with the advertised airdrop theme and further suggests a lack of legitimate content.

Security‑vendor scans on VirusTotal show that 12 of 93 scanners flag the domain as malicious, and Gridinsoft assigns a trust score of 0 / 100, reflecting a high confidence of malicious intent. The domain appears on at least one public blocklist and is listed as blocked by the PhishDestroy service. The intelligence categorizes the activity as a crypto scam, and the domain explicitly impersonates the zkSync brand. The combination of a recent registration, lack of SSL, low trust score, and multiple vendor detections points to a coordinated attempt to lure victims into fraudulent cryptocurrency offers.

Defenders should add the domain and its associated IP address to outbound‑traffic deny lists, monitor DNS queries for the two Cloudflare nameservers, and ensure that any internal security‑aware browsers block access to the site. Because the site is currently offline, continuous re‑checking of its status is advised, as threat actors may reactivate the domain or shift to new infrastructure. Correlation with other observed zkSync‑related phishing artifacts may help identify broader campaign infrastructure. The evidence presented justifies treating the domain as high‑risk and taking proactive mitigation steps.