zk-polyhedra[.]com

Analysis of zk-polyhedra.com confirms it as a crypto-themed phishing domain targeting users with a fraudulent airdrop scam. The domain, created on February 21, 2026, resolved to IP 190.115.21.51 (AS59692, IQWeb FZ-LLC, Belize) and displayed the page title 'Polyhedra $ZK Airdrop,' explicitly signaling its intent to deceive victims with promises of cryptocurrency rewards. Infrastructure checks reveal the domain is associated with an 'Airdrop Scam' phishing kit, a common tool for harvesting credentials or draining wallets under the guise of token distributions. Detection metrics corroborate its malicious classification: the domain appears on three security blocklists, including PhishDestroy, ScamSniffer, and Enkrypt, and is flagged by 4 of 93 security vendors on VirusTotal.

AlienVault OTX records two threat intelligence pulses referencing this domain, further validating its use in active campaigns. Scamadviser and Gridinsoft assign trust scores of 1/100 and 0/100, respectively, reflecting negligible legitimacy. The SSL certificate, issued by R3, provides no meaningful trust signal, as phishing sites routinely use valid certificates to appear authentic. As of July 24, 2026, the domain is offline, though this status may change.

Defenders should treat zk-polyhedra.com as confirmed malicious infrastructure, blocking it at DNS and proxy layers. Historical WHOIS data and passive DNS records should be reviewed to identify related domains or IPs linked to the same threat actor. Given the crypto focus, wallet addresses or smart contract interactions associated with this campaign should be flagged for monitoring or freezing. No evidence suggests this domain targets a specific brand beyond the generic 'Polyhedra' reference in the page title, but the scam type aligns with broader trends in airdrop fraud.