vieron[.]app

The domain vieron.app has been confirmed as an active crypto drainer site designed to harvest cryptocurrency wallet credentials. This threat operates under the guise of an AI subscription service, promoting a deceptive page titled 'Vieron — AI subscriptions in one click'. The domain's infrastructure leverages social engineering tactics to trick users into connecting their wallets under the false pretense of accessing AI services. No direct ties to a specific brand were observed in this campaign, suggesting a standalone operation targeting unsuspecting users. vieron.app resolves to the IP address 138.201.82.173 and was registered on April 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Its SSL certificate was issued by Let's Encrypt, a common tactic to appear legitimate. VirusTotal detection remains low at 1/95 security vendors, indicating stealthiness, while Google Safe Browsing has not flagged this domain as of the latest checks. The domain has not yet accumulated significant blocklist entries, highlighting the importance of proactive detection. As of the latest assessment, this domain remains active and poses an elevated risk to users engaging with its fraudulent AI subscription claims. Immediate actions include blocking the domain at the network perimeter and updating endpoint protections to detect wallet drainer behavior. While current blocklist adoption is minimal, the lack of widespread detection underscores the need for rapid dissemination of this advisory. Remaining risk is elevated due to the domain's fresh registration and low visibility in security vendor feeds.