zerionwallet-scan[.]web[.]app

Analysis of the domain zerionwallet-scan.web.app indicates it is actively hosting a crypto drainer operation, a high-risk threat designed to siphon cryptocurrency from victims' wallets. The domain was registered on January 8, 2019, through Google Firebase and currently resolves to the IP address 199.36.158.100. Security vendors have flagged this domain extensively: 13 of 91 vendors on VirusTotal detect it as malicious, while Google Safe Browsing classifies it under social engineering. Additionally, the domain appears on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL, further corroborating its malicious nature. Infrastructure analysis reveals the domain is hosted on Firebase, a legitimate platform often exploited for phishing due to its ease of deployment and low cost.

The use of Firebase aligns with observed tactics in crypto drainer campaigns, where attackers leverage trusted cloud services to evade initial suspicion. The IP address 199.36.158.100 is associated with Google Cloud infrastructure, which is consistent with Firebase-hosted domains but provides no inherent indication of legitimacy. No SSL certificate anomalies or HTTP status irregularities were reported in the available data, though this does not diminish the domain's confirmed malicious classification. The exact content of the page remains unanalyzed, but the threat type—crypto drainer—suggests it is designed to trick users into connecting their wallets, likely through deceptive prompts mimicking legitimate wallet interactions.

Defenders should treat this domain as an active threat and prioritize blocking it at the network and endpoint levels. Organizations using MetaMask or similar wallet extensions should ensure their blocklists are updated to include this domain, as existing protections from major vendors are already in place.