04-directslots[.]web[.]app

This domain, 04-directslots.web.app, has been identified as a generic phishing resource impersonating TronX, a cryptocurrency-based gaming platform. The page title, 'TronX แตกง่าย - สล็อตเว็บตรง API แท้ 100%', explicitly references TronX services, suggesting an attempt to deceive users seeking legitimate gaming or gambling portals. No specific drainer kit signatures have been confirmed at this stage, though the domain exhibits characteristics consistent with credential harvesting or fraudulent transaction redirection schemes targeting Southeast Asian markets. Infrastructure analysis reveals the domain is hosted on Google Firebase, a platform frequently exploited for rapid deployment of phishing resources due to its free tier and SSL provisioning. The domain currently resolves to the IP address 199.36.158.100, a Google Cloud IP range associated with Firebase hosting. VirusTotal detection metrics show 0/95 security vendors flagging the domain as malicious, indicating either a novel campaign or effective evasion techniques. The SSL certificate is issued by Google Trust Services (WR4), providing a veneer of legitimacy. At present, the domain appears on a single security blocklist, PhishDestroy, while Google Safe Browsing has not yet classified it as harmful. The domain remains active and under investigation, with no takedown actions observed as of the latest assessment. The low detection rate combined with the use of reputable hosting infrastructure presents a moderate risk of successful compromise for unprotected users. Organizations are advised to implement network-level blocking for 04-directslots.web.app and the associated IP 199.36.158.100. End users should verify domain authenticity before entering credentials or financial details, particularly when accessing purported gaming or cryptocurrency services. Continuous monitoring of this infrastructure is recommended due to the potential for rapid evolution of the phishing payload.