whitelist-bonkboxes[.]web[.]app

This domain, whitelist-bonkboxes.web.app, is identified as an active credential harvesting site designed to deceive users into submitting sensitive authentication details. Analysis of the page title, labeled 'Maintenance,' indicates an attempt to impersonate legitimate system maintenance notifications, a common tactic in phishing campaigns to exploit user trust and urgency. The domain specifically targets individuals expecting service updates or temporary access restrictions, increasing the likelihood of successful credential compromise. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain is registered through Google LLC and resolves to the IPv6 address 2620:0:890::100, hosted on AS54113 (Fastly, Inc.) in the United States. It employs an SSL certificate issued by Google Trust Services (WR4), which may lend a false sense of legitimacy to unsuspecting users. Detection metrics further corroborate the malicious nature of this domain: it is flagged by 2 security blocklists and has been identified by 1 out of 95 security vendors on VirusTotal. Additionally, the domain is actively blocked by two independent security filtering systems. Users who have interacted with whitelist-bonkboxes.web.app should immediately take corrective actions to mitigate potential risks. Any credentials entered on this site should be considered compromised and changed without delay, particularly for accounts associated with financial, corporate, or personal services. System scans using updated security tools are recommended to detect potential secondary infections or unauthorized access attempts. Organizations should also review network logs for connections to the domain or its resolving IP address (2620:0:890::100) and implement temporary block rules to prevent further exposure. Awareness training on recognizing maintenance-themed phishing lures is advised to reduce future susceptibility.