zerionwallet[.]io

This domain, zerionwallet.io, is identified as a brand impersonation threat specifically targeting Zerion, a cryptocurrency wallet and DeFi platform. The site mimics the legitimate Zerion Wallet interface, presenting itself under the page title 'Zerion Wallet: Crypto & DeFi - Chrome Web Store,' a clear attempt to deceive users into believing it is an official extension or service. No direct evidence of a drainer kit is observed in initial analysis, though the domain exhibits characteristics consistent with credential harvesting or wallet compromise schemes commonly deployed in crypto-phishing campaigns. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on February 21, 2026, and resolves to the IP address 147.93.37.45. As of the latest scan, the domain is flagged by 5 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. The domain appears on three independent security blocklists and is actively blocked by MetaMask, SEAL, and PhishDestroy. The SSL certificate is issued by GoDaddy.com, Inc., and the web server is identified as running Nginx with OpenResty, a configuration occasionally leveraged in phishing infrastructure for its reverse proxy and load balancing capabilities. Gridinsoft assigns the domain a trust score of 0 out of 100, further corroborating its malicious classification. The domain is currently offline, likely following takedown actions or suspension by the registrar. Despite its inactive status, residual risk persists due to potential DNS caching, residual user exposure, or re-registration under altered infrastructure. Users who interacted with the domain prior to its takedown are advised to revoke any connected wallet permissions, rotate credentials, and monitor associated accounts for unauthorized transactions. Organizations operating in the cryptocurrency sector should update their threat intelligence feeds to include this domain and its associated IP to prevent future exposure.