project-appeal-form-8642594281[.]web[.]app

The domain project-appeal-form-8642594281.web.app was observed hosting a Social Media Phishing campaign that impersonates Facebook. Registration data indicates the domain was created through Google LLC, and its authoritative nameservers are listed as ns-cloud.googledomains.com, consistent with Google’s Cloud DNS service. Network analysis shows the domain resolves to the IP address 199.36.158.100, which belongs to AS54113 Fastly, Inc. and is geolocated in the United States. The HTTPS endpoint presents a certificate issued by Google Trust Services under the WR4 chain, confirming the use of Google‑managed TLS infrastructure.

HTTP probing returned a 404 status code, and the page title reported by the scanner is "Facebook," matching the declared brand target. The site employs Firebase hosting, enforces HSTS, and supports HTTP/3, reflecting a modern web stack often leveraged by threat actors to increase credibility and performance. Threat intelligence flags the domain on a single security blocklist and records that it has been blocked by PhishDestroy. VirusTotal scans show that 15 of 95 security vendors have flagged the domain as malicious, providing independent corroboration of its phishing nature.

Current operational status is offline, suggesting the campaign has been taken down or is temporarily inactive. Defenders should add the fully qualified domain name to network and endpoint blocklists, monitor for any new subdomains that resolve to the same Fastly IP range, and consider extending filtering rules to capture other Firebase‑hosted domains that may be used in similar impersonation attempts. Continuous surveillance of Google Cloud registrars and rapid response to newly detected certificates issued by Google Trust Services can help mitigate future deployments of this technique.