nodeconnections-v3[.]web[.]app

Analysis of nodeconnections-v3.web.app indicates that the site is currently offline, returning HTTP 404 responses. The domain is hosted on Google’s Firebase platform and serves content over HTTPS with HSTS and HTTP/3 enabled, using a Google Trust Services certificate issued to “WR4”. DNS resolution points to 199.36.158.100, an address owned by Fastly (AS54113) in the United States.

The authoritative nameservers are ns-cloud.googledomains.com, confirming registration through Google LLC. The page title returned by the server is “Dex Community”, which does not correspond to any known legitimate brand and suggests a generic phishing front‑end. VirusTotal records show that one of ninety‑five scanning engines flagged the domain, and the domain appears on a single external blocklist, identified by PhishDestroy as malicious. No additional intelligence such as Safe Browsing or Open Threat Exchange entries is available.

The combination of a Firebase‑based hosting stack, a valid Google‑issued TLS certificate, and the presence of a blocklist entry demonstrates that the domain was actively used for phishing, even though it has been taken offline. Defenders should continue to block the hostname and its IP address in perimeter defenses, monitor for any re‑registration or reuse of the same IP range, and update URL filtering policies to include the observed page title “Dex Community”. Because the domain’s infrastructure components (Firebase hosting, Fastly CDN, Google DNS) are widely used, future phishing campaigns may leverage similar configurations; therefore, security teams should treat any new subdomains under the same registrar or CDN with heightened scrutiny until they are verified.