vid-lv[.]web[.]app

vid-lv.web.app has been identified as an active generic phishing domain with an elevated risk level. This domain mimics legitimate video services to harvest user credentials or distribute malware. It exploits Google's Firebase hosting to evade detection while maintaining a facade of legitimacy through a Google Trust Services SSL certificate. This domain was flagged after security vendor VirusTotal detected 12 out of 95 engines identifying it as malicious. It resolves to IP 199.36.158.100 and is registered through Google LLC, leveraging Firebase’s infrastructure. The domain has been blocked by OISD and appears on one additional security blocklist. Despite its SSL certificate from Google Trust Services, the high detection rate and blocklist inclusion indicate active abuse. Users should avoid interacting with vid-lv.web.app, particularly any login prompts or embedded files. If exposed, users are advised to change passwords and enable multi-factor authentication on linked accounts. Security teams should block the domain at the network level and monitor for related IOCs, including the IP 199.36.158.100. Reports to relevant threat intelligence platforms are recommended to aid in broader mitigation efforts.