testnet-bridge[.]zkxpla[.]io

PhishDestroy identifies testnet-bridge.zkxpla.io as an active crypto wallet phishing domain engineered to trick users into surrendering private keys or seed phrases under the pretense of a cross-chain bridge interface. The domain leverages a deceptive naming convention that mimics legitimate zero-knowledge proof (ZK) rollup or layer-2 bridge services. No known drainer kit signature or cloned branding repository has been publicly associated with this domain at this time, suggesting a recently deployed or bespoke phishing campaign.

Domain forensic analysis reveals a pristine reputation profile with 0 out of 95 VirusTotal engines flagging the URL as malicious, alongside a freshly issued SSL certificate from Let’s Encrypt and resolution to IP 76.76.21.164. Registered through Gabia, Inc. on May 12, 2025, the domain remains absent from Google Safe Browsing and has not yet propagated widely across public blocklists. These early-stage indicators suggest opportunistic targeting rather than large-scale distribution.

As of today, the threat is classified as active with an under-investigation risk level pending deeper behavioral analysis. Immediate response includes flagging the domain via internal threat intel platforms and blocking 76.76.21.164 at the network perimeter. While the current risk is assessed as low-to-medium due to limited detections, the domain’s youth and phishing intent warrant elevated monitoring. Users should avoid interacting with testnet-bridge.zkxpla.io, and organizations are advised to update DNS blocklists and SIEM rules to prevent accidental exposure.