fomo-lookup[.]firebaseapp[.]com

The domain fomo-lookup.firebaseapp.com is currently flagged as an active phishing vector that leverages a fake airdrop narrative. Infrastructure analysis shows the host resolves to the IPv6 address 2620:0:890::100, which is assigned to Fastly, Inc. (AS54113) and geolocated to the United States. The site was served using Google‑hosted Firebase infrastructure, confirmed by the presence of Firebase technology signatures and an SSL certificate issued by Google Trust Services (certificate identifier WR4). TLS configuration includes HSTS and the service supports HTTP/3, indicating a modern web stack despite the malicious purpose.

Public threat intelligence reports that the page title returned by the server is "FOMO - Portfolio & Airdrops Tracker," matching the advertised airdrop theme. An HTTP 404 response was observed, and the domain has been taken offline, consistent with the "offline" status recorded in the intelligence feed. VirusTotal scans show that three of ninety‑five security vendors flagged the domain, providing independent confirmation of malicious activity. The domain appears on five external blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, reinforcing its reputation as a phishing host.

The phishing kit associated with the domain is identified as an "Airdrop Scam," suggesting that victims are likely to be lured with promises of free token distributions in exchange for private keys or wallet credentials. Registration details indicate the domain was provisioned through Google Firebase, a service that can be abused for rapid deployment of malicious sites. No nameserver information is available, which is typical for Firebase‑hosted domains.

While the site is presently offline, defenders should continue to monitor the associated IP range and Fastly edge nodes for re‑use, as threat actors often redeploy malicious payloads on the same infrastructure.