bonkboxes-live[.]web[.]app

This domain, bonkboxes-live.web.app, is flagged for brand impersonation, specifically targeting Google. The site was observed to be offline, with a page title 'Maintenance,' which is often used to disguise malicious activities. Analysis indicates that the domain poses an elevated risk to users who may be tricked into believing it is an official Google service, leading to potential credential theft or other forms of fraud.

Infrastructure analysis reveals that bonkboxes-live.web.app resolves to the IPv6 address 2620:0:890::100 and is registered through Google LLC. The domain uses an SSL certificate issued by Google Trust Services, which can lend false credibility to the site. According to VirusTotal, 5 out of 95 security vendors flag this domain as malicious, suggesting that while the threat is recognized, it may still evade some detection mechanisms. The domain also utilizes Firebase, HSTS, and HTTP/3, technologies that can enhance the sophistication and resilience of the phishing infrastructure. Furthermore, the domain appears on 2 security blocklists, indicating its malicious nature.

If users have visited bonkboxes-live.web.app, they should immediately check their Google account for any unauthorized activity. It is recommended to change passwords and enable two-factor authentication if not already in place. Users should also monitor their accounts for any unusual transactions or changes and report any suspicious activity to their respective service providers. Additionally, users should avoid clicking on links from unknown sources and verify the authenticity of any communication purporting to be from Google or other trusted brands.