zkpass[.]icu

Analysis of zkpass.icu indicates a high‑risk crypto‑draining infrastructure targeting Discord users. The domain was created on December 17, 2025 and registered through Global Domain Group LLC. It resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are celine.ns.cloudflare.com and peyton.ns.cloudflare.com, both Cloudflare‑managed, suggesting the operator leveraged Cloudflare’s DNS and CDN services. No SSL certificate is presented for the site, leaving the HTTP connection unencrypted.

The page title observed during the brief crawl was "zkPass Airdrop Portal – Official ZKP Airdrop Guide & Claim Instructions (2025)", explicitly referencing an airdrop theme and implying a connection to Discord, which is confirmed by the listed brand target. The site employed the publicly known Airdrop Scam phishing kit and the Angel Drainer cryptocurrency‑exfiltration kit, aligning with the classification of a social‑media phishing campaign that seeks to drain crypto assets. Trustworthiness metrics are poor: Gridinsoft assigned a score of 0 / 100, and the domain appears on one security blocklist. VirusTotal analysis recorded 12 detections out of 93 scanning engines, indicating that a minority of security vendors flagged the domain as malicious.

PhishDestroy has also blocked the site. As of the report date, July 23 2026, the domain is offline, but the underlying IP and hosting configuration remain active and could be repurposed for future campaigns. Defenders should immediately add zkpass.icu to block lists, monitor traffic to 188.114.96.3 for any resurgence, and enforce strict URL filtering for Discord‑related communications. Continuous observation of Cloudflare‑hosted domains that exhibit similar registration patterns or employ the Angel Drainer kit is recommended to pre‑empt re‑use of this infrastructure.