airdrop[.]zklpass[.]org

This domain, airdrop.zklpass.org, operates as a brand impersonation phishing site targeting Discord users. Analysis indicates the infrastructure is designed to deceive victims into believing they are interacting with legitimate Discord airdrop or reward programs. The site employs social engineering tactics, such as fake token distributions or exclusive community benefits, to harvest user credentials, payment details, or other sensitive information. The threat is classified as elevated due to its direct targeting of a widely used communication platform and the potential for significant user compromise. Infrastructure analysis reveals the domain was registered on December 19, 2025, through Web Commerce Communications Limited, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 172.67.196.219, which has been flagged in multiple security contexts. Detection metrics show that 3 out of 95 security vendors on VirusTotal have identified the domain as malicious, while it appears on 2 distinct security blocklists. These indicators, combined with a Gridinsoft trust score of 0/100, underscore the domain's malicious intent and the urgency of mitigation efforts. Additional scrutiny by threat intelligence platforms, including ScamSniffer and PhishDestroy, has resulted in active blocking of the domain. Users who have visited airdrop.zklpass.org or interacted with its content should take immediate action to mitigate potential risks. First, credentials entered on the site must be considered compromised and should be reset across all platforms where identical or similar passwords were used. Multi-factor authentication (MFA) should be enabled on all critical accounts to prevent unauthorized access. Victims should also monitor their accounts for suspicious activity, such as unauthorized logins or transactions, and report any anomalies to the affected service providers. If financial information was submitted, users are advised to contact their financial institutions to secure their accounts and review recent transactions for fraudulent activity. Finally, affected systems should be scanned for malware to ensure no secondary infections were introduced during the interaction with the phishing domain.