ebi-xyz[.]com

Analysis of the domain ebi-xyz.com shows that it was registered on 25 September 2024 through NiceNIC International Group Co., Limited. The site serves content over HTTPS using a Let’s Encrypt certificate (R13) and resolves to the IPv4 address 185.149.120.107, which is announced by AS57724 (DDOS‑GUARD LTD) and geolocated to Russia. The web server identified is Nginx. The page title returned by the HTTP request is “Ebi xyz: First DEX with HOT Wallet Ebi.xyz exchange on Telegram”, and the domain is explicitly marked as impersonating the Solana brand. The domain appears on a single security blocklist and has been flagged by PhishDestroy. Reputation services assign a Scamadviser score of 1/100 and a Gridinsoft score of 0/100, both indicating extreme distrust. The site is currently live, returning HTTP 200. No detections are reported by VirusTotal (0/95), but the absence of signatures does not constitute evidence of safety. The content beyond the title has not been publicly disclosed, leaving the exact malicious payload or credential‑harvesting mechanisms unknown. The combination of a low‑reputation registrar, Russian‑based hosting, and a brand‑impersonation focus suggests a high likelihood of a cryptocurrency‑related scam, consistent with the listed scam type. Defenders should add ebi-xyz.com and its resolving IP 185.149.120.107 to block lists and intrusion‑prevention systems. Monitoring of DNS queries for the domain and of outbound traffic to the IP is advised. Users of Solana‑related services should be warned about the domain’s claim of a “first DEX with HOT Wallet” and instructed to verify official URLs. Continuous re‑scanning of the site on multi‑engine services is recommended to detect any future malicious payloads.