ronin-wallet[.]firebaseapp[.]com

This domain, ronin-wallet.firebaseapp.com, is an active crypto drainer infrastructure impersonating the Ronin Wallet brand, as indicated by its page title and confirmed brand impersonation classification. Registered on March 31, 2022, through Google LLC, the domain resolves to IP 199.36.158.100, hosted on Google Cloud infrastructure in the US. The SSL certificate is issued by Google Trust Services (WR4), and the site returns an HTTP 200 status, confirming operational status as of July 12, 2026. Analysis reveals a high-risk profile: the domain is flagged by 16 of 91 security vendors on VirusTotal and appears on three security blocklists. Independent trust assessments assign scores of 1/100 and 0/100, reinforcing its malicious classification. No legitimate nameservers are associated with the domain, a common trait in ephemeral phishing setups. While the exact content and mechanics of the drainer are not yet analyzed, the combination of brand impersonation, crypto-focused threat type, and active blocklisting by wallet security providers indicates a targeted attack vector against cryptocurrency users. Defenders should treat this domain as compromised infrastructure. Immediate actions include adding the domain and its resolving IP to blocklists, monitoring for related subdomains or redirect chains, and alerting users to the impersonation of Ronin Wallet. Given the domain's longevity and persistent activity, assume it remains under adversary control unless evidence of takedown emerges. Further investigation into associated wallet addresses or transaction patterns is recommended to trace stolen assets.