zkspass[.]org

Analysis of zkspass.org confirms it as a brand-impersonation phishing domain targeting Google. The domain was registered on December 17, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, and was taken offline by the time of this report on July 24, 2026. Infrastructure analysis reveals the domain resolved to IP 216.58.206.68, geolocated in Germany under AS15169 (Google LLC), though this IP association does not confirm hosting legitimacy. No SSL certificate was present, increasing the risk of unencrypted credential interception.

The page title was explicitly 'Google,' aligning with the reported scam type of brand impersonation. Detection data indicates the domain was flagged by 9 out of 93 security vendors on VirusTotal and appeared on 2 security blocklists. It was also blocked by PhishDestroy and ScamSniffer, further validating its malicious classification. Nameservers julio.ns.cloudflare.com and sureena.ns.cloudflare.com suggest Cloudflare infrastructure, though this alone does not confirm protective proxy status.

The Gridinsoft trust score of 0/100 reinforces the domain's high-risk profile. While the exact content of the site remains unanalyzed, the combination of a Google-branded page title, absence of SSL, and detection by multiple security vendors confirms its role in phishing operations. Defenders should treat this domain as malicious, block resolutions, and monitor for related infrastructure reuse. No evidence of active hosting or redirects exists as of the report date, but historical logs should be reviewed for prior connections.