frowncoin[.]firebaseapp[.]com

On July 25 2026, the domain frowncoin.firebaseapp.com was analyzed as a high‑risk crypto‑scam phishing infrastructure. The domain was registered on 21 February 2026 through Google LLC’s Firebase service, which automatically assigns the Google‑managed nameservers ns‑cloud‑c1.googledomains.com, ns‑cloud‑c2.googledomains.com, and ns‑cloud‑c3.googledomains.com. DNS resolution points to the IP address 199.36.158.100, which belongs to AS54113 Fastly, Inc. in the United States. The site presents a TLS certificate issued by Google Trust Services under the WR4 identifier, confirming the use of Google’s certificate authority. HTTP probing returns a 404 status with the page title “Site Not Found”, indicating that the content is currently unavailable or has been removed.

Detected web technologies include the Firebase hosting platform, HTTP/3 support, and HTTP Strict Transport Security (HSTS), consistent with a cloud‑based deployment. Reputation checks show that nine of ninety‑three VirusTotal scanners flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat. Independent blocklists maintained by PhishDestroy, MetaMask, and SEAL have listed the host, and the domain appears on three additional security blocklists. These signals collectively confirm malicious intent despite the inactive page. The specific scam type is identified as a crypto‑scam, though the exact payload or credential‑harvesting mechanism has not been observed because the site is offline.

Uncertainty remains regarding the original malicious content, the target audience, and whether the domain was ever actively serving phishing pages. No further artifacts such as phishing email samples or credential‑stealing URLs have been recovered. Defenders should continue to block the domain at perimeter and DNS layers, monitor the associated IP address for any re‑activation, and consider adding the host to internal threat‑intel feeds.