zksync-blog-git-adding-to-prividium-the-tm-matter-labs-651a8986[.]vercel[.]app

The domain zksync-blog-git-adding-to-prividium-the-tm-matter-labs-651a8986.vercel.app is actively engaged in brand impersonation targeting zkSync, a Layer 2 scaling solution for Ethereum. Analysis confirms the domain is currently operational and designed to deceive users into believing it is an official zkSync communication or resource. This activity aligns with tactics used to distribute crypto drainers or harvest credentials under false pretenses. Infrastructure analysis reveals the domain is registered through Vercel Inc. and resolves to the IP address 64.29.17.67, hosted on Amazon.com, Inc. (AS16509) in the United States. The SSL certificate is issued by Google Trust Services (WR1), a common feature in both legitimate and malicious domains to avoid immediate suspicion. Security telemetry indicates the domain is flagged by 15 of 95 vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. Additionally, the domain appears on one security blocklist, and its page title, 'ZKsync: The Elastic Network,' mimics official zkSync branding to enhance credibility. Current status remains active, posing an ongoing risk to users unfamiliar with zkSync’s legitimate domains. Organizations and individuals are advised to block the domain and its resolving IP at the network level. Users should verify all zkSync-related communications through official channels, particularly those involving wallet connections or transaction prompts. Security teams are recommended to monitor for related infrastructure, such as subdomains or newly registered domains with similar naming patterns, and update detection rules to include this indicator of compromise.