tnlfinacialvoicesms-online[.]firebaseapp[.]com

This domain, tnlfinacialvoicesms-online.firebaseapp.com, is actively engaged in brand impersonation targeting Base, a recognized cryptocurrency platform. The threat type is classified as high-risk due to its fraudulent representation of the Base brand, designed to deceive users into disclosing sensitive credentials or financial information. As of the latest assessment, the domain remains operational and unmitigated, posing an ongoing risk to potential victims. Analysis indicates the domain was registered through Google Firebase on April 15, 2026, and resolves to the IP address 199.36.158.100, hosted by Google LLC in the United States. Security vendor detections on VirusTotal report 15 of 95 engines flagging the domain as malicious, while it appears on one additional security blocklist. The SSL certificate is issued by Google Trust Services under the WR4 intermediate, a common characteristic of legitimate and malicious Firebase-hosted domains alike. Infrastructure analysis reveals the domain leverages Firebase’s hosting services, which, while providing a legitimate appearance, is frequently abused for phishing campaigns due to its ease of deployment and low cost. Current status confirms the domain remains active and unblocked by most security controls outside of specific detection engines. Organizations and individuals are advised to implement immediate network-level blocking of the domain and its resolving IP address, 199.36.158.100, to prevent user exposure. Endpoint protection systems should be updated to include this domain in phishing and brand impersonation signatures. Security teams are further recommended to monitor for related domains utilizing the same Firebase infrastructure or SSL certificate authority, as threat actors often reuse these patterns across multiple campaigns. User awareness training should emphasize the risks of interacting with unsolicited communications referencing Base or similar platforms, particularly those hosted on cloud services.