violation-management-a6bc6[.]web[.]app

PhishDestroy identifies violation-management-a6bc6.web.app as a brand impersonation threat targeting Facebook users. This fraudulent page mimics the authentic Facebook login interface to harvest credentials, posing an elevated risk to visitors who may unknowingly surrender their login details. The domain leverages social engineering tactics by adopting a legitimate-sounding name and mimicking Facebook’s branding to deceive users into entering sensitive information. No drainer kit components were observed in the initial analysis, but the page’s primary function clearly indicates credential theft as its core malicious purpose. This domain resolves to IP address 199.36.158.100 and was registered through Google LLC. It currently holds a VirusTotal detection score of 11/95 security vendors and has been flagged and blocked by the OISD blocklist. The domain features a Google Trust Services SSL certificate, which may lend it an appearance of legitimacy. It has appeared on 1 known security blocklist and uses a subdomain structure typical of Firebase-hosted phishing pages (web.app). The domain’s creation date and full WHOIS history remain under review, but its technical footprint aligns with common phishing infrastructure. As of the latest assessment, violation-management-a6bc6.web.app remains active and accessible, with ongoing attempts to deceive users. Immediate response actions include broad blocklisting by security vendors and domain takedown efforts coordinated through Google Firebase support. Despite these efforts, the domain persists with elevated risk due to its active status and the potential for continued user exposure. Users are strongly advised to avoid this domain entirely, verify URLs before login, and report suspicious pages to Facebook and relevant security teams. Remaining risk is elevated due to active impersonation and moderate detection coverage.