zksync[.]airdropsalert[.]live

The domain zksync.airdropsalert.live is currently taken offline but was observed serving HTTP 200 responses before removal. Infrastructure analysis shows the host resolves to IP address 142.250.181.228, an address owned by AS15169 Google LLC located in the United States. Registration was performed through Cloudflare, Inc., and no authoritative nameserver records were returned, indicating the use of Cloudflare's privacy shielding services. The site presented a page title of "Google" and offered no SSL certificate, suggesting an unencrypted HTTP service.

Threat intelligence flags this domain as a fake airdrop campaign impersonating the zkSync brand. VirusTotal scanned the domain and 13 of 95 security vendors reported it as malicious. The domain appears on a single security blocklist and is specifically blocked by PhishDestroy. These indicators collectively point to a brand‑impersonation operation designed to lure zkSync users into a fraudulent airdrop scheme.

Content of the landing page has not been publicly disclosed, and the lack of TLS, combined with the generic page title, leaves the exact visual lures unknown. Defenders should add zksync.airdropsalert.live to URL filtering and blocklists, monitor for other domains using similar Cloudflare‑based registration and Google‑hosted IPs, and advise users to verify any airdrop communications against official zkSync channels. Continuous re‑evaluation is recommended in case the site is re‑hosted or the threat actor reactivates the domain.