zksync[.]airdropsalert[.]app

The domain zksync.airdropsalert.app was identified as a brand‑impersonation conduit targeting users of the zkSync platform. The site was hosted on infrastructure owned by Google LLC, as indicated by its resolution to the IP address 142.250.184.228 which belongs to ASN 15169 located in the United States. Registration records show the domain was provisioned through Cloudflare, Inc., and no TLS certificate was presented when the site was reachable, meaning communications were not protected by HTTPS. Analysis by multiple security vendors on VirusTotal reveals that 16 of 95 scanners flagged the domain as malicious, consistent with its classification as a crypto‑related scam.

The page title returned by the HTTP response was simply “Google”, providing no indication of the intended spoofed content. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service, confirming its status as a malicious resource. A proprietary trust score from Gridinsoft assigned the domain a rating of 0 out of 100, reflecting an extreme lack of credibility. The site was previously associated with a “Crypto Scam” label and explicitly impersonates the zkSync brand, suggesting that it may have been used to lure victims into divulging private keys or sending funds.

As of the report date the domain has been taken offline, but the underlying infrastructure—Google’s IP space and Cloudflare registration—remains valid and could be reused for future campaigns. Defenders should continue to block the domain at perimeter filters, monitor for re‑registration attempts, and incorporate the IP address 142.250.184.228 into threat‑intel feeds. Organizations employing zkSync should educate users about unsolicited links and verify that legitimate zkSync communications never originate from this domain. Ongoing vigilance is advised, especially given the low trust score and the presence of multiple vendor detections.