# PhishDestroy threat dossier — zkshining.xyz ================================================================ Fetched: 2026-05-17 22:44:40 UTC Canonical: https://phishdestroy.io/domain/zkshining.xyz/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 87/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Solana ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/95 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Forcepoint ThreatSeeker ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 216.198.79.1 (US, Atlanta) ASN: AS16509 Amazon.com, Inc. Hosting org: Lefkoff Industries Registrar: Spaceship, Inc. Nameservers: launch1.spaceship.net, launch2.spaceship.net Registered: 2025-11-02 Page title: zkShining - Zero-Knowledge Privacy Infrastructure for Solana HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R12 Expires: 2026-07-23 Status: INVALID chain Fingerprint: bde85075c3ea78bc9903823d71de2050d9daca6e180181ea551e7e8458aade32 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2025-11-02 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-17 12:22:19 UTC (by PhishDestroy tracker) Last verified: 2026-05-18 00:31:36 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e353b-0e60-72da-befa-6c289b0c3fba/ Wayback Machine: https://web.archive.org/web/*/zkshining.xyz crt.sh CT logs: https://crt.sh/?q=%25.zkshining.xyz Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=zkshining.xyz AlienVault OTX: https://otx.alienvault.com/indicator/domain/zkshining.xyz URLhaus: https://urlhaus.abuse.ch/host/zkshining.xyz/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-17 12:22:51 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies zkshining.xyz as an active crypto drainer domain designed to deceive users into connecting cryptocurrency wallets and approving malicious transactions. This domain mimics legitimate crypto service providers to trick victims into signing transactions that drain digital assets directly from connected wallets. The threat actor behind this campaign leverages social engineering tactics, often disseminated through fake airdrop announcements, fraudulent NFT mint pages, or impersonated exchange interfaces, to lure cryptocurrency users into interacting with the malicious site. Once a user connects their wallet and approves a transaction, the drainer silently transfers funds to attacker-controlled addresses without further user interaction, exploiting the irreversible nature of blockchain transactions. This domain was flagged by PhishDestroy with a high-risk assessment based on multiple indicators of compromise. VirusTotal analysis reveals that only 2 out of 95 security vendors currently detect zkshining.xyz as malicious, indicating a low initial detection rate that may allow the threat to evade some security measures. The domain resolves to IP address 216.198.79.1 and was registered through Spaceship, Inc. on November 02, 2025, a suspiciously recent creation date that suggests this campaign is part of a short-lived operation designed to avoid long-term scrutiny. The presence of a Let's Encrypt SSL certificate does not indicate legitimacy, as threat actors frequently abuse free certificate authorities to enhance the appearance of authenticity. The low VirusTotal detection rate combined with recent registration and hosting on a single IP address creates an elevated risk profile for this domain. Users who have visited zkshining.xyz should immediately disconnect their cryptocurrency wallets from the site and revoke any token approvals that may have been granted during the visit. Check wallet transaction histories for unauthorized transfers and report any suspicious activity to both the wallet provider and relevant cryptocurrency exchange platforms. Consider transferring remaining assets to a new wallet with a different seed phrase to prevent potential future exploitation. Implement enhanced security measures such as hardware wallet usage, multi-signature setups, and transaction simulation tools to detect malicious contract interactions before approval. Monitor security forums and threat intelligence feeds for updates on this campaign as additional indicators emerge. Report this domain to your antivirus provider and consider blocking the IP address 216.198.79.1 at the network level to prevent further exposure. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 2aac578a44fc6c51c9ac2c0dc0f2334e TLS cert SHA-256: bde85075c3ea78bc9903823d71de2050d9daca6e180181ea551e7e8458aade32 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/zkshining.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=zkshining.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 150,732 domains (32,438 alive under monitoring, 118,014 confirmed takedowns/dead). Site: https://phishdestroy.io