yomnetwork[.]firebaseapp[.]com

The domain yomnetwork.firebaseapp.com was flagged on July 24, 2026 as part of a generic phishing campaign delivering a crypto‑related scam. Infrastructure analysis shows the hostname resolves to the IP address 199.36.158.100, which belongs to AS54113 Fastly, Inc. and is geolocated in the United States. The TLS certificate presented by the site is issued by Google Trust Services under the WR4 root, confirming the use of Google‑controlled certificate infrastructure. The site is hosted on the Firebase platform, as indicated by the presence of Firebase in the technology fingerprint, and HTTP headers confirm enforcement of HSTS and support for HTTP/3. Public blocklists have recorded the domain on two separate anti‑phishing feeds; it is explicitly blocked by PhishDestroy and ScamSniffer.

VirusTotal has logged a single positive detection out of ninety‑five scanners, reinforcing the suspicion of malicious intent. An HTTP request to the root path returns a 404 status, and the page title returned by the server is “YOM NANO™ - Turn Your Gaming PC Into Passive Income”, which aligns with the declared crypto‑drain scam type. Registration information lists Google LLC as the registrar, consistent with the Firebase hosting environment. The current operational status is reported as offline, and the domain is no longer serving content.

However, the presence of the domain on blocklists and the single VirusTotal detection indicate that it was actively used in a phishing or crypto‑scam campaign. Defenders should continue to monitor the IP address 199.36.158.100 for any re‑use, enforce blocklist rules for the domain, and consider adding it to internal deny lists. Because the underlying hosting provider is a major cloud service, future iterations could be deployed under different subdomains, so vigilance on similar naming patterns and the observed page title wording is advised.