systemutilities[.]web[.]app

This domain, systemutilities.web.app, is currently active and classified as a high-risk generic phishing threat targeting users through the distribution of counterfeit system utility software. Analysis indicates the site is designed to mimic legitimate system optimization or diagnostic tools, potentially tricking users into downloading malicious payloads or disclosing sensitive information under false pretenses. No specific brand impersonation has been confirmed, but the generic nature of the deception increases its potential reach across multiple user segments seeking technical utilities. Infrastructure analysis reveals the domain is registered through Google Firebase and resolves to the IP address 199.36.158.100, hosted on AS54113 (Fastly, Inc.) in the United States. The site is flagged by 1 of 95 security vendors on VirusTotal, a notably low detection rate that may reflect the use of evasion techniques or recent deployment. The SSL certificate is issued by Google Trust Services (WR4), providing a veneer of legitimacy while the domain appears on one security blocklist. The page title, 'System Utilities,' reinforces the deceptive theme, and the domain remains operational as of the latest assessment. The current risk assessment remains high due to the domain's active status, low detection rate, and use of a reputable hosting provider to mask its malicious intent. Organizations and individuals are advised to block the domain at the network level and add the IP address 199.36.158.100 to firewall deny lists. End-users should be educated to recognize generic system utility scams, particularly those hosted on app subdomains with no clear affiliation to established software vendors. Monitoring for related domains or IPs within the same autonomous system (AS54113) is recommended to identify potential lateral threats. Immediate reporting to security teams is advised if any interaction with the domain is detected.