zklink-eligibility[.]pages[.]dev

PhishDestroy confirms zklink-eligibility.pages.dev is a live crypto drainer site masquerading as zkLink Nova’s Aggregated Layer 3 zkEVM network. The page title and branding closely mimic the legitimate zkLink Nova service, aiming to trick users into connecting wallets or transferring assets under the false promise of an “Aggregation Parade.” Security telemetry shows the domain resolves to IP 188.114.96.3, is served through Cloudflare, and carries a Google Trust Services SSL certificate—common cloaking tactics to appear legitimate. VirusTotal’s scan returned only 1 out of 95 engines flagging the domain, indicating low early detection despite active malicious behavior. This domain was flagged within days of creation and continues to operate. Registrar data shows Cloudflare, Inc. as the listed provider, leveraging their fast-flux infrastructure to evade takedowns. The site’s content mirrors official zkLink Nova marketing language, reinforcing the risk of brand impersonation. PhishDestroy’s seed analysis 04ea76 confirms the site remains active, maintaining SSL and hosting on Cloudflare’s edge network to prolong its operational window. If you visited zklink-eligibility.pages.dev, disconnect your wallet immediately and revoke any permissions granted. Check transaction history for unauthorized transfers and report suspicious activity to your wallet provider. Run a malware scan on your device and change passwords used on the site. Report the domain to PhishDestroy and your local cybercrime unit to help block further abuse.