zklpass[.]org

Analysis of the domain zklpass.org, registered through Web Commerce Communications Limited on 19 December 2025, indicates that the site was used for brand impersonation targeting Binance. The site presented the page title “zkPass – Private Data Protocol”, which does not reference the victim brand but the underlying domain was flagged for impersonating Binance. Infrastructure analysis shows the domain resolved to the IP address 188.114.97.3, hosted in the United States under ASN 13335 owned by Cloudflare, Inc. The nameservers jaziel.ns.cloudflare.com and raegan.ns.cloudflare.com confirm the use of Cloudflare’s DNS service. No TLS certificate was observed, indicating the site operated without encryption. VirusTotal scans recorded four positive detections out of ninety‑three submitted engines, confirming malicious classification by multiple vendors.

The domain appears on five independent blocklists – PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura – and the Gridinsoft trust score is 0 out of 100, reinforcing the assessment of high risk. The detection count of four positives reflects consensus among security engines that the site delivered malicious payloads or credential harvesting mechanisms, although the exact payload was not captured in the available intelligence. The absence of an SSL certificate further reduces trust and may have facilitated man‑in‑the‑middle interception. Although the page title references a private data protocol, the branding mismatch suggests the attackers leveraged the zkPass name to lend credibility while redirecting users to Binance‑related phishing pages.

The site has been taken offline as of the report date, but historical evidence suggests it was active for a short window after registration. Defenders should block the domain and its associated IP, monitor DNS queries for the listed Cloudflare nameservers, and include the domain in threat‑intel feeds.