Security researchers have linked one of the biggest cybercrime networks used for online fraud to a company in Latvia called Real Host.
Zeus has linked to Rock Phish, a Russian-led gang blamed for half of the world's phishing attacks to steal credit card and banking information.
But security experts said it was not clear how much of Zeus the Real Host servers controlled and it was said it was extremely difficult to pinpoint the centre of a botnet that large.
The researchers also discovered a range of other cybercriminal activities at Real Host, which is under investigation by Latvia's computing authority.
Real Host, which has been compared to McColo and Atrivo, is also being investigated by Swedish connectivity company Telia, which Real Host is using to connect to the internet.