zkpass[.]network

This investigation documents zkpass.network, a domain observed in a generic phishing campaign and taken offline as of the report date, July 25 2026. The domain was registered on August 22 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. The site presented the page title “Um momento…”, which is the only visible content captured before the takedown. VirusTotal scans recorded three detections out of ninety‑three security vendors, indicating that a minority of AV engines flagged the domain as malicious. The domain appears on a single public blocklist and received a Gridinsoft trust score of zero out of one hundred, reflecting an extremely low reputation.

The SSL certificate is identified as “WE1”, and the domain is listed as blocked by the PhishDestroy service. Risk assessment assigned an elevated level, consistent with its classification as a generic phishing infrastructure. Analysis confirms that the hosting infrastructure, IP address, and geographic location have not been disclosed, limiting attribution. No additional indicators such as URLs, payload hashes, or email samples are available.

Consequently, the primary observable artifacts are the registration record, the page title, and the modest detection footprint. Defenders should add zkpass.network to inbound and outbound filtering policies, ensure that any traffic to the domain is denied, and monitor for newly registered domains that share the same registrar or similar naming patterns. Updating URL‑filtering feeds with the known blocklist entry and incorporating the zero‑score reputation from Gridinsoft can improve early detection. Continuous review of VirusTotal and other multi‑engine scanners for any resurgence of the domain is advised, as well as periodic checks of PhishDestroy listings for related campaigns.