meeting-bonus[.]firebaseapp[.]com

This domain is flagged as a high-risk brand_impersonation threat targeting Microsoft corporate credentials. Analysis indicates the domain meeting-bonus.firebaseapp.com presents a fraudulent login interface titled 'Sign in to your account,' designed to deceive users into submitting authentication details. The threat is classified as active and continues to resolve despite detection by multiple security mechanisms. Infrastructure analysis reveals the domain is registered through Google LLC and resolves to the IP address 199.36.158.100, geolocated in the United States under AS54113 (Fastly, Inc.). The SSL certificate is issued by Google Trust Services (WR4), a legitimate provider, which may contribute to the domain's deceptive appearance of authenticity. VirusTotal reports 16 out of 95 security vendors flagging this domain as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and remains operational at the time of assessment. Mitigation requires immediate blocking of the domain meeting-bonus.firebaseapp.com and its resolving IP 199.36.158.100 at the network perimeter. Organizations should deploy email and web filtering rules to prevent user access to the domain, particularly for messages or links referencing Microsoft login portals. Security teams are advised to monitor for credential submission attempts to this domain and initiate password resets for any accounts potentially exposed. User awareness training should emphasize the risks of brand_impersonation tactics, specifically the use of legitimate-looking login pages hosted on cloud infrastructure (e.g., firebaseapp.com) to bypass initial suspicion.