zecsolswap[.]xyz

This domain is flagged as an elevated-risk phishing site targeting cryptocurrency users. Analysis indicates it impersonates a legitimate decentralized exchange (DEX) by offering SOL to ZEC swaps without leaving a wallet, a common tactic to harvest wallet credentials or private keys. The specific threat involves credential theft, where victims may unknowingly expose their wallet recovery phrases or API keys under the guise of a seamless token swap process. Infrastructure analysis reveals multiple technical indicators of compromise. The domain is detected by 10 out of 95 security vendors on VirusTotal, suggesting broad consensus on its malicious nature. It resolves to the IP address 64.29.17.65 and was registered through NAMECHEAP INC on November 15, 2025, an unusually recent creation date for a purported financial service. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100. SSL certification is provided by Let’s Encrypt, a common but not exclusive indicator of legitimacy, while technologies such as Vercel and HSTS are detected, which may be leveraged to enhance the site’s perceived authenticity. The page title, 'ZecSwap - Swap SOL to ZEC Without Leaving Your Wallet,' directly aligns with known phishing narratives in the cryptocurrency space. Mitigation steps for users and organizations include immediate blocking of the domain and its associated IP address (64.29.17.65) at the network level. Users who interacted with the site should revoke any wallet permissions granted during the session and monitor connected accounts for unauthorized transactions. Cryptocurrency wallet providers and exchanges are advised to flag this domain in their threat intelligence feeds and alert users attempting to access it. Given the domain’s current offline status, defenders should remain vigilant for re-emergence under similar naming conventions or infrastructure, as phishing actors frequently rotate domains to evade detection.