zksync-enterprise-df1wkzlnd-matter-labs-651a8986[.]vercel[.]app

This domain, zksync-enterprise-df1wkzlnd-matter-labs-651a8986.vercel.app, is identified as a high-risk brand impersonation threat targeting zkSync, a Layer 2 scaling solution for Ethereum. Analysis indicates the domain mimics the legitimate zkSync.io platform, likely to deceive users into disclosing sensitive credentials or interacting with malicious smart contracts. The page title explicitly replicates the official branding, suggesting a deliberate attempt to exploit trust in the zkSync ecosystem. No explicit drainer kit signatures were observed, but the infrastructure aligns with common phishing tactics used in cryptocurrency-related fraud. Technical indicators confirm the domain's malicious nature. VirusTotal reports 11 out of 95 security vendors flagging the domain as phishing, while Google Safe Browsing has classified it as a phishing threat. The domain is registered through Vercel Inc. and resolves to the IP address 216.198.79.131, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The SSL certificate is issued by Google Trust Services under the WR1 root, a common configuration for both legitimate and malicious domains. The domain appears on at least one security blocklist, and additional monitoring tools have detected its presence, further corroborating its malicious intent. As of the latest assessment, the domain remains active and unresolved, posing an ongoing risk to users. No takedown actions have been observed, and the infrastructure continues to serve phishing content. Organizations and individuals are advised to block the domain at the network level and monitor for related indicators of compromise. Users should verify the authenticity of any zkSync-related communications by cross-referencing with official channels. The persistence of this threat underscores the need for heightened vigilance in cryptocurrency-related interactions, particularly those involving unsolicited requests for credentials or transactions.