resolvernode[.]firebaseapp[.]com

resolvernode.firebaseapp.com was observed hosting a crypto‑draining phishing campaign. The site returned an HTTP 404 response with the page title “Site Not Found”, indicating that the landing page has been removed but the domain remains registered through Google Firebase. The TLS certificate is issued by Google Trust Services (WR4), confirming the use of Google’s certificate authority. Network analysis shows the domain resolves to 199.36.158.100, an address owned by Fastly, Inc. (AS54113) located in the United States.

VirusTotal records show 14 of 95 scanning engines flag the domain as malicious, and five independent blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have added it to their deny lists. Detected technologies include Firebase hosting, HTTP/3 support, and HTTP Strict Transport Security, all consistent with the infrastructure of a cloud‑based phishing site. The current status is offline, and the HTTP status code is 404, which suggests the malicious page has been taken down or is being rotated.

However, the persistence of the domain registration and the presence on multiple blocklists indicate that the infrastructure may be reused for future campaigns. Defenders should continue to block the domain and the associated IP address, monitor DNS queries for re‑activation, and consider adding the host to internal threat‑intel feeds. Additional investigation is required to retrieve any cached content or phishing kits that may have been served before takedown, as the exact payload and victim targeting remain unknown.