zksync[.]airdrpalerts[.]cfd

Analysis of the domain zksync.airdrpalerts.cfd indicates active brand impersonation targeting zkSync, a known blockchain scaling protocol. The domain was registered on October 25, 2025, through Dynadot LLC and is currently offline as of July 23, 2026. Infrastructure analysis reveals Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com) and resolution to IP 142.250.185.164, hosted under AS15169 (Google LLC) in the United States. No SSL certificate was detected, increasing the risk of unencrypted data transmission if the site were operational.

Detection data shows the domain appears on one security blocklist (PhishDestroy) and holds a Gridinsoft trust score of 0/100, signaling high suspicion. Fourteen of 95 security vendors on VirusTotal flagged the domain as malicious, though the specific nature of the threat (e.g., credential harvesting, malware distribution) remains unconfirmed due to its offline status. The page title, 'Google,' does not align with the domain name or the impersonated brand, a common tactic to evade basic detection filters. Defenders should treat this domain as part of a broader phishing campaign targeting zkSync users, particularly given its recent creation and alignment with blockchain-related scams.

While the site is offline, historical resolution to Google LLC infrastructure suggests potential abuse of legitimate services for malicious purposes. Organizations should monitor for related domains using similar naming patterns (e.g., 'airdrpalerts') and block access to this domain across security controls. Further investigation into associated IP addresses and registrar activity may uncover additional linked infrastructure.