check-fomo[.]web[.]app

This domain, check-fomo.web.app, is actively engaged in brand impersonation targeting Google. Analysis indicates the page presents itself as a portfolio tracker titled 'FOMO - Portfolio Tracker,' a common tactic to deceive users into believing they are interacting with legitimate Google financial or productivity services. The infrastructure is designed to harvest credentials or sensitive information under false pretenses, leveraging the trust associated with the impersonated brand.

Technical indicators confirm the domain's malicious nature. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious. The domain is registered through Google LLC and resolves to the IP address 199.36.158.100. Its SSL certificate is issued by Google Trust Services (WR4), which may contribute to its appearance of legitimacy. The domain appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. No creation date is publicly available, but its active status and blocklist presence suggest recent malicious activity.

As of the latest verification, check-fomo.web.app remains active and unmitigated. The domain continues to resolve and serve content, posing an ongoing risk to users. Organizations and individuals are advised to block access to the domain and IP address at the network level. Users should be alerted to the presence of this impersonation scheme, particularly those interacting with financial or portfolio management services. Continuous monitoring of related infrastructure is recommended to identify and neutralize emerging threats from this campaign.