zeusmix[.]biz

Analysis of zeusmix.biz indicates a high‑confidence cryptocurrency impersonation campaign targeting Solana users. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the IPv4 address 178.17.62.19, which is assigned to AS200823 MHost LLC in Germany. Hosting infrastructure is identified as Ubuntu with an Nginx web server, and the site presented a TLS certificate issued by Let’s Encrypt (certificate identifier E7). The page title observed before takedown reads “Ethereum Mixer (Litecoin Mixer), Solana Mixer | ZeusMix”, confirming the use of the ZeusMix brand to lure victims into a crypto mixing service that falsely claims support for Solana.

The threat is catalogued as a crypto scam and classified under brand impersonation of Solana. Security telemetry shows the domain is listed on one public blocklist and was actively blocked by the PhishDestroy service. VirusTotal scans report 16 detections out of 94 security vendors, and the Gridinsoft trust score is 0 / 100, reinforcing malicious intent. The site returned HTTP 200 during the period it was live, indicating a functional web service before being taken offline.

Current status is offline, but the underlying infrastructure and registration details remain observable. Uncertainty remains around the exact payload delivered to visitors, as no sandbox or content analysis is provided, and the specific monetary loss figures are not disclosed. Defenders should continue to monitor the associated IP address and ASN for any re‑use, enforce blocklist updates, and ensure that any internal Solana‑related URLs or wallet addresses are protected by domain‑level allow‑list policies. Incident response teams should also flag any outbound traffic to 178.17.62.19 as suspicious, and threat‑intel feeds should be updated to reflect the brand‑impersonation nature of this campaign.