wlshibonk[.]web[.]app

This domain, wlshibonk.web.app, poses a high-risk brand impersonation threat targeting users of the Phantom cryptocurrency wallet. The site falsely advertises a "PUMP Airdrop" to deceive visitors into connecting their wallets or divulging sensitive credentials, such as recovery phrases or private keys. Such scams typically lead to unauthorized access to digital assets, immediate fund theft, or installation of malicious smart contracts designed to drain wallets upon interaction. Analysis indicates the domain is registered through Google LLC and resolves to the IP address 216.198.79.67, hosted on Amazon.com, Inc. infrastructure (AS16509). The SSL certificate is issued by Google Trust Services (WR4), a common tactic to appear legitimate. As of the latest scan, only 1 out of 95 security vendors on VirusTotal flags this domain, suggesting it may evade detection by less sophisticated security tools. The domain appears on two security blocklists and is actively blocked by at least two threat intelligence platforms. No historical registration data is publicly available, but the use of Google's web.app subdomain service suggests recent creation to exploit current trends in cryptocurrency airdrops. Users who visited wlshibonk.web.app should assume their wallet credentials or connected sessions may be compromised. Immediate action is required: revoke any active wallet connections to the site via the Phantom wallet interface, transfer funds to a new wallet with a fresh recovery phrase, and monitor all linked accounts for unauthorized transactions. If recovery phrases or private keys were entered, consider all associated wallets permanently compromised. Enable transaction previews and multi-factor authentication where available, and report the domain to relevant threat intelligence platforms to aid in broader detection efforts. Avoid interacting with any further communications related to this airdrop, as follow-up phishing attempts via email or social media are likely.