zerionwallet-tracker[.]web[.]app

This domain, zerionwallet-tracker.web.app, is currently under investigation for operating as a crypto drainer. Analysis indicates it impersonates Zerion, a legitimate cryptocurrency wallet tracker and portfolio management platform, likely to deceive users into connecting their wallets. The site employs social engineering tactics, presenting itself as a tool for monitoring crypto assets while executing unauthorized transactions to drain funds from connected wallets. No specific drainer kit has been confirmed at this stage, but the domain’s structure and content align with known crypto drainer campaigns targeting decentralized finance (DeFi) users. Technical indicators reveal the domain has a VirusTotal detection score of 0/95, meaning no security vendors have flagged it as malicious at the time of analysis. It is registered through Google LLC and resolves to the IP address 199.36.158.100. The domain is hosted on Google’s Firebase platform, a common infrastructure for both legitimate and malicious applications. No creation date is publicly available due to Firebase’s domain registration obfuscation. Google Safe Browsing (GSB) currently does not list the domain as unsafe, and no blocklist entries have been recorded across major threat intelligence feeds. The page title, 'Crypto Wallet Tracker & Portfolio Tracking | Zerion,' further reinforces the impersonation attempt. As of the latest assessment, zerionwallet-tracker.web.app remains active and unflagged by most security tools. No takedown requests or sinkholing actions have been observed. Users are advised to exercise extreme caution when interacting with the domain, particularly when prompted to connect a wallet or input seed phrases. Cryptocurrency holders should verify the authenticity of any wallet tracker by cross-referencing official sources and using browser-based security extensions to detect potential threats. Given the domain’s current undetected status, manual verification and avoidance are critical to mitigating risk.