zksync-os-dapp-portal[.]web[.]app

Analysis indicates that zksync-os-dapp-portal.web.app is an active brand-impersonation domain targeting zkSync, a Layer 2 scaling solution for Ethereum. The domain was registered on October 1, 2025, through Google LLC and currently resolves to IPv6 address 2620:0:890::100, hosted on AS54113 (Fastly, Inc.) in the United States. The page title, 'ZKsync Bridge | Transfer funds between ZKsync and Ethereum,' explicitly mimics zkSync's official bridging functionality, suggesting an intent to deceive users into interacting with fraudulent smart contracts or wallet-draining mechanisms. Infrastructure analysis reveals the use of Node.js, Firebase, Vue.js, Nuxt.js, and Rudderstack, alongside HSTS and HTTP/3, which are consistent with modern web applications but do not inherently indicate malicious activity. The SSL certificate is issued by Google Trust Services (WR4), a legitimate provider, and no nameservers were detected in the provided data. The domain is flagged on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Three of 91 security vendors on VirusTotal have detected this domain as malicious. The domain remains operational as of July 12, 2026, with an HTTP 200 status code, confirming its accessibility. No evidence of takedown requests or sinkholing was observed. Defenders should treat this domain as high-risk due to its brand-impersonation classification, blocklist presence, and association with a known scam type. Further investigation is recommended to determine the exact nature of the fraudulent activity, such as whether it involves fake token swaps, wallet credential harvesting, or smart contract exploits. Organizations should monitor for connections to this domain and assess any associated wallet addresses or smart contracts for malicious behavior.