kast-io[.]web[.]app

PhishDestroy identifies kast-io.web.app as an active crypto drainer phishing domain registered through Google LLC and currently resolving to IP 199.36.158.100. This domain employs a generic phishing vector to deceive users into connecting cryptocurrency wallets under the false pretense of legitimate services, with the malicious infrastructure hosted on Google’s Firebase platform to evade traditional detection mechanisms. Technical indicators confirm the following: VirusTotal detection score is 10/95 engines, domain registered via Google LLC, IP resolution to 199.36.158.100, SSL certificate issued by Google Trust Services, and domain creation timestamp remains undetermined due to Firebase’s dynamic subdomain handling. Despite the absence of immediate detections, the infrastructure’s reliance on Google’s ecosystem introduces plausible deniability and operational longevity. This domain remains active and under investigation with a status of 'under investigation' and risk level categorized as 'high' due to the potential for real-time asset exfiltration. Organizations and users are advised to block kast-io.web.app at the network and endpoint levels, avoid interaction, and report the domain to threat intelligence platforms and browser security vendors. Remaining risk is mitigated only through proactive blocking, as the domain’s Firebase hosting and SSL certification by Google Trust Services reduce immediate visibility for automated defenses. Continuous monitoring of wallet drainer IOCs is recommended to prevent exposure.