zerionswallet[.]web[.]app

PhishDestroy identifies zerionswallet.web.app as an active brand impersonation phishing site targeting users of Zerion, a popular DeFi wallet interface. This fraudulent domain mimics the legitimate Zerion brand to deceive users into connecting their crypto wallets or entering sensitive credentials, with the intent to drain digital assets. The site is hosted on Google’s Firebase platform (web.app), leveraging Google’s SSL certificate to appear legitimate at first glance. However, multiple threat intelligence sources and security vendors have flagged this domain as malicious, including blocklists maintained by SEAL and MetaMask, indicating elevated risk and confirmed malicious intent. This domain was flagged by 2 out of 95 VirusTotal security vendors, showing partial but significant detection of its malicious nature. It was registered through Google LLC via the Firebase hosting service, which is commonly abused for phishing due to its free tier and trusted infrastructure. While the domain uses a valid SSL certificate issued by Google Trust Services—often a trust signal for users—this should not be relied upon as a sole indicator of safety. The domain impersonates the Zerion brand, a well-known platform in the cryptocurrency space, and has been actively blocked by major security tools, including SEAL and MetaMask, due to its involvement in crypto drainer activity. These drainers typically inject malicious scripts that monitor wallet connections and silently approve unauthorized token transfers once a user connects their wallet. If you visited zerionswallet.web.app, do not enter any wallet credentials, seed phrases, or private keys. Disconnect your wallet immediately if prompted, and revoke any suspicious token approvals using tools like Etherscan or Revoke.cash. Scan your device with reputable antivirus software, especially if you entered sensitive information. Consider transferring remaining funds to a new, secure wallet if you suspect compromise. Always verify URLs carefully and use bookmarks or official apps when accessing financial services. Report suspicious domains to your security provider or community blocklists to help protect others.