zksync-tax[.]pages[.]dev

The domain zksync-tax.pages.dev has been identified as a potential brand impersonation threat targeting the cryptocurrency platform zkSync. This domain attempts to mimic zkSync’s branding, potentially to deceive users into divulging sensitive information, though no crypto drainer kit has been confirmed at this stage. The threat type is classified as brand impersonation, and the risk level remains under investigation as PhishDestroy continues to monitor its activity.

Technical analysis reveals that zksync-tax.pages.dev currently holds a VirusTotal detection score of 3 out of 95, indicating that it has not yet been flagged by antivirus engines. The domain resolves to the IP address 188.114.97.3 and was registered through Cloudflare, Inc., a common registrar used by both legitimate and malicious actors. It uses an SSL certificate issued by Google Trust Services, which can lend an appearance of legitimacy to unsuspecting users. There is no record of Google Safe Browsing (GSB) blacklisting or blocklist counts reported at this time, which suggests the domain has not yet triggered widespread automated defenses.

As of now, the status of zksync-tax.pages.dev is active and it continues to impersonate zkSync without immediate detection by major security tools. PhishDestroy recommends users exercise extreme caution and verify any interactions with this domain directly through official zkSync communication channels. Security teams should consider monitoring the IP 188.114.97.3 and associated infrastructure for suspicious activity. While no direct evidence of credential harvesting or crypto draining has surfaced, the impersonation tactic alone represents a significant risk to users and warrants ongoing vigilance and timely response.