fixedrapidlyapprovals[.]web[.]app

Analysis of fixedrapidlyapprovals.web.app (seed f10579) reveals a Firebase-hosted domain exhibiting characteristics consistent with phishing infrastructure. The domain was flagged by a single security blocklist (PhishDestroy) and is currently offline, returning HTTP 404. No detections were recorded by the 95 vendors that scanned the domain on VirusTotal, though the absence of detections does not confirm benign status. Infrastructure analysis indicates the domain is registered through Google LLC and resolves to IPv6 address 2620:0:890::100, hosted on AS54113 (Fastly, Inc.) in the United States.

The SSL certificate is issued by Google Trust Services (WR4), and the domain employs HSTS and HTTP/3 protocols. Nameservers are ns-cloud.googledomains.com, consistent with Google Cloud infrastructure. The page title, 'fixedrapidlyapprovals NodeRectifier,' provides no clear indication of a targeted brand or specific phishing campaign, and no additional context (e.g., credential-harvesting kit, brand impersonation) is available in the current intelligence. The domain's classification as 'generic phishing' remains provisional pending further evidence.

Defenders should treat this domain as suspicious based on its blocklist inclusion and Firebase hosting, a common vector for phishing due to its low-cost, high-availability nature. Monitoring for re-activation or related subdomains under web.app is recommended. No evidence links the domain to a specific threat actor or campaign at this time.