fomo-lookup[.]web[.]app

Analysis dated July 24, 2026 indicates that the sub‑domain fomo-lookup.web.app was provisioned through Google Firebase and served using a Google Trust Services WR4 TLS certificate. The site presented the page title 'FOMO – Portfolio & Airdrops Tracker', a phrasing commonly associated with cryptocurrency airdrop scams. Infrastructure inspection shows the host resolves to 199.36.158.100, an address owned by Fastly, Inc. (ASN 54113) located in the United States. Detected technologies include Firebase hosting, HTTP Strict Transport Security and HTTP/3, confirming a modern CDN‑based deployment.

VirusTotal scans recorded four detections out of ninety‑five AV engines, and the domain appears on five independent blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura. Scamadviser assigns a trust score of 1 out of 100, reflecting extreme risk. The page currently returns HTTP 404 and the domain has been taken offline, but the historical footprint aligns with a known 'Airdrop Scam' phishing kit that lures victims with promises of free token allocations.

Defenders should continue to block the domain and its associated IP, monitor Fastly edge nodes for similar Firebase‑hosted payloads, and update URL filtering rules to include the observed TLS certificate issuer. Incident response teams are advised to correlate any authentication attempts or wallet address disclosures against the observed page title and kit fingerprint, as compromised credentials are likely to target cryptocurrency portfolios. Ongoing surveillance is recommended because the underlying hosting infrastructure can be rapidly repurposed for new malicious campaigns.