app-fxrpfi-flare-8eh83djy83n[.]firebaseapp[.]com

The domain app-fxrpfi-flare-8eh83djy83n.firebaseapp.com is currently active and identified as a high-risk brand impersonation threat targeting Base, a cryptocurrency platform. Analysis indicates this infrastructure is designed to facilitate crypto drainer attacks, where victims are tricked into connecting wallets to malicious smart contracts, resulting in unauthorized fund transfers. The domain remains operational as of the latest verification, posing an ongoing risk to users. Infrastructure analysis reveals the domain was registered through Google Firebase on May 11, 2026, an unusually future-dated creation that may indicate an attempt to evade detection or exploit misconfigured systems. It is flagged by 2 of 95 security vendors on VirusTotal, a relatively low detection rate that suggests either recent deployment or obfuscation techniques. The domain appears on three security blocklists, indicating prior identification by threat intelligence platforms. No associated IP addresses or hosting providers were provided in the initial data, but Firebase-hosted domains typically resolve to Google Cloud infrastructure, which may complicate takedown efforts due to distributed hosting environments. Current status confirms the domain remains active, and the risk level is classified as high due to its direct targeting of cryptocurrency users. Users are strongly advised to avoid interacting with this domain or any links directing to it. Organizations should update web filters and endpoint protection rules to block access to app-fxrpfi-flare-8eh83djy83n.firebaseapp.com. Cryptocurrency wallet providers and exchange platforms are recommended to monitor for transaction patterns linked to this domain and alert users attempting to connect wallets to it. Given the future-dated registration, further investigation into the registrar's records may be warranted to identify potential abuse of Firebase's domain registration process.