zksync[.]airdrpsalerts[.]info

Analysis conducted on July 25, 2026 identifies zksync.airdrpsalerts.info as a confirmed credential phishing domain targeting the zkSync brand. The domain is currently offline, having been taken down following detection by security vendors. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolved to the IP address 172.253.115.147, hosted under AS15169 (Google LLC) in the United States. No SSL certificate was present at the time of assessment, increasing the risk of credential interception during transmission.

The page title, 'Google,' does not align with the domain's stated purpose, suggesting an attempt to mislead users or evade automated detection systems. Detection data indicates the domain appeared on at least one security blocklist, and 14 of 95 security vendors on VirusTotal flagged it as malicious. The domain was specifically blocked by PhishDestroy, further corroborating its classification as a phishing threat. While the exact content of the page remains unanalyzed due to its offline status, the available evidence—including the domain name, brand impersonation, and detection counts—strongly supports its classification as a credential phishing site.

Defenders are advised to treat this domain as malicious and maintain its inclusion in blocklists. Organizations should monitor for any attempts to re-register or re-host the domain under alternative infrastructure. Given the targeting of zkSync, users and administrators in the cryptocurrency and blockchain sectors should be particularly vigilant for similar impersonation attempts. No additional details regarding the phishing kit or specific user interactions are available at this time.