waitingpackageco[.]web[.]app

Analysis of the domain waitingpackageco.web.app indicates active involvement in a delivery scam operation, as classified by threat intelligence sources. The domain, registered on April 15, 2026, through Google LLC, resolves to the IP address 199.36.158.100, hosted within the United States under Google LLC infrastructure. The site returns an HTTP 200 status code, signaling an operational web presence, and presents a page titled 'Verification,' which aligns with common phishing tactics used to deceive users into submitting personal or financial details under false pretenses. Technical indicators reveal the use of Firebase and reCAPTCHA, alongside HSTS and HTTP/3 protocols, suggesting an attempt to appear legitimate while maintaining modern web security standards. The SSL certificate is issued by Google Trust Services (WR4), which does not inherently validate the site's legitimacy but ensures encrypted connections. The domain lacks configured nameservers, a potential red flag for hastily deployed malicious infrastructure. Trust scores from Gridinsoft and Scamadviser are both at 1/100, reinforcing its classification as high-risk. The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. As of July 12, 2026, 15 out of 94 security vendors on VirusTotal flag the domain as malicious, providing further evidence of its harmful nature. Defenders should treat this domain as a confirmed delivery scam threat, block it at the network level, and monitor for associated indicators of compromise. The exact content or branding targeted by the site remains unconfirmed beyond the 'Verification' page title, and further analysis of the site's payload is recommended to identify additional attack vectors or victim profiles.