goldfish-ticket[.]web[.]app

This domain, goldfish-ticket.web.app, is currently flagged as a high-risk phishing site targeting users of Goldfish Token, a cryptocurrency platform. Analysis indicates the domain is actively serving fraudulent content under the guise of a legitimate token dashboard. The threat type is categorized as generic_phishing, with no evidence of additional payload delivery or exploit kit activity at this time. The domain remains operational and accessible as of the latest verification. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Google LLC via Firebase hosting services. It resolves to the IP address 199.36.158.100, which is geolocated in the United States and associated with Google LLC infrastructure. The SSL certificate is issued by Google Trust Services (WR4), a common configuration for Firebase-hosted applications. Detection metrics show minimal coverage, with only 1 of 95 security vendors on VirusTotal flagging the domain. However, it appears on two independent security blocklists and is actively blocked by at least two domain reputation systems. The page title, 'Goldfish Token Dashboard,' directly mimics legitimate cryptocurrency interfaces, increasing the likelihood of successful credential harvesting. The domain remains active and poses a significant risk to users unfamiliar with cryptocurrency phishing tactics. Organizations and individuals are advised to block access to goldfish-ticket.web.app at the network perimeter and update endpoint protection rules to deny resolution. Users who may have interacted with the domain should revoke any active sessions, rotate credentials, and monitor associated cryptocurrency wallets for unauthorized transactions. Security teams should treat this domain as a confirmed malicious indicator and include it in threat intelligence feeds for proactive detection.