zksync[.]portal-drops[.]icu

This domain, zksync.portal-drops.icu, poses a targeted phishing threat designed to impersonate the zkSync crypto wallet platform. Analysis indicates the site is engineered to deceive users into entering sensitive credentials, such as private keys or recovery phrases, by mimicking the legitimate zkSync interface. The page title 'Google' suggests an attempt to disguise the malicious content as a trusted service, increasing the likelihood of successful social engineering attacks against cryptocurrency users. Infrastructure analysis reveals the domain was registered on October 20, 2025, through Dynadot LLC, and currently resolves to the IP address 142.250.185.100. Security vendor assessments on VirusTotal show 6 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist and was proactively blocked by at least one threat intelligence feed. The combination of recent registration, brand impersonation, and partial vendor detection elevates the risk profile of this infrastructure. Users who visited zksync.portal-drops.icu should immediately revoke any active sessions associated with zkSync or related crypto wallets. All credentials entered on the site must be considered compromised and should be changed from a secure device. Affected users are advised to monitor their wallet transactions for unauthorized activity and enable multi-factor authentication on all crypto-related accounts. If private keys or recovery phrases were exposed, migrating assets to a new wallet is strongly recommended to prevent theft.