zksync-blog-8629nddwp-matter-labs-651a8986[.]vercel[.]app

This domain, zksync-blog-8629nddwp-matter-labs-651a8986.vercel.app, is flagged as a high-risk brand impersonation targeting zkSync, a known blockchain scaling solution. Registered on November 21, 2025, through Vercel Inc., the domain resolves to IP 198.18.1.167, hosted on Amazon Web Services (AS16509) in the US. Infrastructure analysis reveals the use of Vercel nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and an SSL certificate issued by Google Trust Services. The page title, 'ZKsync: The Elastic Network,' directly references the legitimate zkSync brand, indicating an intent to deceive users familiar with the platform. Technologies detected include React, Stripe, Sendgrid, and Google Sign-in, suggesting a sophisticated setup designed to mimic legitimate authentication and payment flows. The domain is currently active, returning an HTTP 302 redirect status, which may be used to funnel victims to a secondary malicious endpoint. Google Safe Browsing has flagged the domain for social engineering, and it appears on at least one security blocklist. While five security vendors on VirusTotal have flagged this domain, the exact nature of the threat beyond brand impersonation remains unconfirmed due to limited public analysis of the page content. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where zkSync or related blockchain services are accessed. Monitoring for outbound connections to 198.18.1.167 or interactions with the detected technologies (e.g., Stripe, Google Sign-in) may help identify compromised endpoints. Given the domain's recent registration and active status, further investigation into associated infrastructure (e.g., redirect targets, linked payment processors) is recommended to disrupt the campaign.