documenttossscc[.]web[.]app

PhishDestroy identifies documenttossscc.web.app as a live generic phishing site built on Google’s Firebase hosting to masquerade as a document-sharing portal. Behind the scenes, the domain resolves to IP 199.36.158.100 and currently evades all antivirus engines, showing zero detections out of 95 scanners on VirusTotal. The page is served over a Google-issued SSL certificate, giving visitors a false sense of legitimacy while attackers harvest credentials or deliver malicious payloads.

Technical analysis reveals the domain was registered through Google LLC and remains under active use. Its generic nature suggests it could be recycled for broader campaigns, such as fake invoice drops or HR document lures. With no current blocklist presence and a clean SSL heritage, the site is ripe for exploitation until sandbox detections or network IOCs catch up. The registrar’s lack of proactive takedown suggests this infrastructure will persist until escalated by threat researchers or affected brands.

If you accessed this site, assume your data may have been exposed. Disconnect from sensitive networks, rotate passwords used on the page, and run a full antivirus scan. Report the domain to your security team and enable two-factor authentication on any accounts you entered. Monitor financial transactions and watch for follow-on phishing attempts—this campaign may pivot quickly to exploit captured credentials.