crmcupoflb[.]firebaseapp[.]com

This domain, crmcupoflb.firebaseapp.com, is actively engaged in brand impersonation targeting Base, a customer relationship management platform. The site presents a fake login interface under the page title 'Verificando,' designed to harvest user credentials. Analysis indicates the domain is structured to mimic legitimate Base authentication portals, increasing the likelihood of successful phishing attempts against unsuspecting users. Infrastructure analysis reveals the domain is hosted on Google Firebase (crmcupoflb.firebaseapp.com), resolving to the IP address 199.36.158.100, located in the US under AS54113 (Fastly, Inc.). The SSL certificate is issued by Google Trust Services (WR4), a common tactic to lend false legitimacy. The domain is flagged by 18 out of 95 security vendors on VirusTotal and appears on one security blocklist. It remains active as of the latest verification, with no indication of takedown efforts by the registrar, Google LLC. Users who have visited crmcupoflb.firebaseapp.com or entered credentials on the site should immediately revoke access to any sessions associated with Base or connected applications. Reset passwords for Base and any other accounts where the same credentials may have been reused. Enable multi-factor authentication where available. Monitor accounts for unauthorized activity, including logins from unfamiliar locations or devices. If financial or sensitive data was entered, consider reporting the incident to relevant authorities and conducting a full security review of affected systems.