zkshining[.]xyz

Analysis indicates that zkshining.xyz is an active brand‑impersonation infrastructure targeting Solana. The domain was registered on 02 Nov 2025 through Spaceship, Inc., and uses the launch1.spaceship.net and launch2.spaceship.net name servers. DNS resolution points to IP 216.198.79.1, which is located in the United States and attributed to Lefkoff Industries. The web server presents a TLS certificate issued by Let’s Encrypt (R12) and responds with HTTP 307 redirects. Detected technologies include Vercel hosting and HTTP Strict Transport Security (HSTS). The page title returned by the server reads “zkShining – Zero‑Knowledge Privacy Infrastructure for Solana,” confirming the Solana brand reference. VirusTotal reports five of ninety‑one scanners flagging the domain, and Gridinsoft assigns a trust score of 19 / 100, reflecting a low confidence rating. The domain is currently listed on one security blocklist and has been blocked by the PhishDestroy system. Risk level is assessed as high and the campaign remains active. Defenders should add the domain and its associated IP address to outbound and inbound block lists, monitor DNS queries for the listed name servers, and update intrusion‑prevention signatures to capture the Vercel‑based hosting pattern. Users should be warned against interacting with any unsolicited communications referencing Solana that direct to this domain, and any credentials entered should be considered compromised. Further forensic analysis of the site content is required to determine additional malicious payloads.