zerion-tracker[.]firebaseapp[.]com

This domain, zerion-tracker.firebaseapp.com, is identified as an active brand impersonation threat targeting Zerion, a cryptocurrency wallet and portfolio management platform. Analysis indicates the infrastructure is designed to deceive users into believing they are interacting with legitimate Zerion services, likely facilitating unauthorized transactions or credential harvesting. No explicit crypto drainer kit signatures were observed in initial scans, though the domain structure and hosting pattern align with known impersonation tactics used in prior campaigns. Infrastructure analysis reveals the domain was registered through Google LLC on April 08, 2026, and currently resolves to the IP address 199.36.158.100, hosted within Google LLC’s US-based infrastructure. The domain is secured with an SSL certificate issued by Google Trust Services (WR4), a common tactic to lend false legitimacy. Detection metrics show 12 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on three independent security blocklists. Google Safe Browsing (GSB) has not yet classified the domain, though this may reflect a lag in propagation rather than benign status. As of the latest verification, zerion-tracker.firebaseapp.com remains active, displaying a 'Site Not Found' page title, which may indicate either a placeholder state or a cloaking mechanism to evade automated detection. The domain is blocked by multiple cryptocurrency-focused security layers, including transaction monitoring and wallet protection systems. Despite these mitigations, the risk of user exposure persists due to the domain’s plausible naming convention and hosting under a trusted provider. Users are advised to treat any interaction with this domain as malicious and verify all cryptocurrency-related communications through official Zerion channels only.