auction-zkp[.]app

This domain is flagged as a crypto presale drainer targeting users through a fraudulent Zero Knowledge Proof (ZKP) auction scheme. Analysis indicates the threat is designed to siphon cryptocurrency from victims by luring them into connecting wallets to malicious smart contracts under the guise of an exclusive token presale. The domain exhibits high-risk characteristics, though its current status is offline, suggesting either takedown or temporary suspension of operations. Infrastructure analysis reveals the domain auction-zkp.app was registered on March 07, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which has been observed in prior phishing campaigns. Detection metrics show 0 detections out of 95 engines on VirusTotal, indicating a lack of prior flagging, though it appears on three security blocklists and is blocked by multiple wallet protection mechanisms. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. The domain employs a Let’s Encrypt SSL certificate, a common tactic to lend superficial legitimacy to fraudulent sites. Mitigation against this crypto drainer requires heightened vigilance from users and organizations. Individuals should verify presale announcements exclusively through official project channels and avoid connecting wallets to unfamiliar domains, even if they appear professionally designed. Wallet providers are advised to preemptively block interactions with the domain and its associated IP address. Security teams should monitor for residual infrastructure, such as subdomains or related IPs, and update blocklists to include auction-zkp.app and 188.114.96.3. Given the domain’s recent creation and lack of prior detections, this campaign may represent a zero-day threat, necessitating proactive defense measures.