Our automated security review found no threat indicators on web.app. The site appears legitimate based on the signals we checked, but always stay alert for phishing emails that spoof real domains.

Is web.app safe to use?

web.app passed our automated security checks with a trust score of 93/100. No antivirus engines or major blacklists flagged the site at the time of the last scan.

Does web.app have a valid SSL certificate?

Yes. web.app presents a valid TLSv1.3 certificate issued by Google Trust Services · WR4, expiring in 59 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.

How old is the web.app domain?

web.app is 7.4 years old, registered on 1/8/2019 through MarkMonitor Inc.. Scam domains are often freshly registered — a site under 6 months old warrants extra caution.

Has web.app been flagged by antivirus engines?

No. All 92 antivirus engines in our malware network report web.app as clean.

Is web.app on any phishing or malware blacklists?

No. web.app is not currently listed on the major browser blocklist feeds that modern browsers use.

Where is web.app hosted?

web.app resolves to an IP operated by Google LLC in US (usage type: Content Delivery Network). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.

Is web.app a well-known website?

Yes. web.app sits in the global top-100k on Cloudflare Radar, which means it has substantial real-world traffic. That does not automatically make it safe, but established brands almost always rank here and throwaway scam domains almost never do.

Security Review

Is web.app legit or a scam?

Our verdict:Safe· 93/100

SafeSuspiciousDangerous

The official apex domain for Google Firebase Hosting, a legitimate global infrastructure service with a clean security record and multi-year history.

Why we trust it

Owned and operated by Google LLC with verified business registration.Zero detections across 92 antivirus engines in our security network.Domain has been active and stable for over 7 years.

web.appScanned 1h ago

Post Facebook

Trust score

SAFE

Heuristics 88·MT 95

Warning signals (1)

Redirects to another domain

Positive signals (5)

Antivirus clear Not on major blacklists Domain is 7 years old Encrypted connection Clean server reputation

View density

Analysis Summary

Threat Intelligence

0/92

All engines report clean

Domain Age

7 years old

Registered Jan 8, 2019

MT Intelligence

Safe

Low likelihood · 98% confidence

SAFE

No threats detected

All checks passed. This site appears legitimate — but always stay alert for phishing even on trusted domains.

Website Preview

LIVE RENDER

web.app

1Professional layout consistent with official Google Firebase branding

Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site. See full visual analysis →

Visual Screenshot Analysis

We capture a fresh screenshot of the live page and ask a vision model to look for scam visual patterns — fake trust badges, countdown timers, overlay pop-ups, and visual clones of legitimate brands.

/ 100

No visual red flags

No scam visual patterns detected

The screenshot displays the legitimate, fully-rendered landing page for Firebase Hosting with no visual indicators of scam activity or cloning.

Visual risk0/100

What our vision model saw

5 signals

Professional layout consistent with official Google Firebase branding

High-quality graphics and typography with no broken elements

Standard navigation menu with functional links to documentation and console

No fake trust badges or urgency tactics present

Clean, professional design with no intrusive pop-ups or overlays

MT Intelligence

Advanced threat intelligence

MT Security Analyst

Low scam likelihoodengineMT · Guardiantrust95/100

MT AgentLive web researchVisual inspection

Confidence

The domain is owned and operated by Google LLC, as confirmed by business registration records and its long-standing history since 2019. Our antivirus network shows zero detections across more than 90 security engines. The page content and visual layout are professional, consistent with official branding, and contain no deceptive elements. While some subdomains on this platform are occasionally abused by third parties for phishing, the root domain itself is a safe, essential piece of web infrastructure. We have high confidence in its legitimacy based on its global traffic rank and verified ownership.

Full dossier

Analysis complete

Page Content

The site serves as the primary informational hub for Firebase Hosting. It features technical documentation, product features like global CDN and SSL integration, and links to the official Google Cloud console. There are no signs of credential harvesting or fake promotions.

Infrastructure

The site is hosted on Google's own infrastructure with a valid SSL certificate issued by Google Trust Services. It loads resources from trusted internal domains such as gstatic.com and google-analytics.com. The technical setup is consistent with a high-traffic, enterprise-grade service.

Domain History

Registered in early 2019 via MarkMonitor, a registrar typically used by major corporations for brand protection. The domain has maintained a consistent purpose as a hosting gateway for over five years.

Web Reputation

The domain holds a top-tier global traffic rank. While research indicates that scammers sometimes use free subdomains (e.g., [name].web.app) to host temporary phishing pages, the apex domain web.app is recognized as a legitimate service provider. Major security blocklists and antivirus engines treat the root domain as safe.

Risk Factors

Subdomains on this platform are frequently abused by third parties for phishing due to the free hosting tier.
The site does not list a direct contact email or physical address on the landing page, as it is a technical product hub.

Positive Signals

Owned and operated by Google LLC with verified business registration.
Zero detections across 92 antivirus engines in our security network.
Domain has been active and stable for over 7 years.
High global traffic ranking indicates a massive, legitimate user base.
Professional design with functional links to official documentation and developer tools.

AI Recommendation

You can safely use this site. If you encounter a specific link ending in '.web.app' that asks for passwords or payment info unexpectedly, treat that specific subdomain with caution.

Next-gen fraud intelligence

Evidence-backedCross-checked

Web Research Findings

Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for web.app, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.

Domain age

7.4 yrs

Registered Jan 2019

Business registration

Active · US

Site traces back to an actively registered business.

Clone check

Not a clone

No well-known site's layout or branding detected here.

Typosquat check

No look-alike match

The domain doesn't resemble any well-known brand's spelling.

Web mentions

2 scam reports · 1 complaint

Key findings

7 headline facts from open-web research

web.app is owned and operated by Google LLC (registrant per WHOIS); registered January 8, 2019, via MarkMonitor, expires 2027.
Official landing page promotes Firebase Hosting: "Fast, secure hosting for static websites" with global CDN, zero-config SSL, and support for React, Vue, etc.
Firebase Hosting provides free subdomains on *.web.app (and *.firebaseapp.com) for every project; these serve the same deployed static/SPA content.
Scammers frequently abuse free Firebase Hosting subdomains (e.g., metabusiness-support-f801.web.app) for phishing pages, often sent via Facebook Messenger, as they appear legitimate and are free/easy to obtain.
Reddit discussion (2023) notes uptick in web.app phishing links that redirect to ngrok or credential-stealing forms; users advised to report abuse to Google.
No evidence of the apex domain web.app itself being malicious; complaints target user-created subdomains hosted via the legitimate Firebase platform.
Domain age ~7.5 years (2719 days aligns with 2019 registration); no business complaints or negative reviews found for the root domain.

Scam reports (2)

Direct quotes from public scam databases, forums, and news.

Reddit r/cybersecurity_helpopen
"I'm seeing a major uptick where the phishing link domain is "@.web.app". ... Anyone can get a subdomain of web.app domain by using Google Firebase hosting"
Reddit r/cybersecurity_helpopen
"Scammers need to make up "reasonable-sounding" URLs and registering actual domains cost $$$ and can be taken away. If they can find cheap/free subdomains, even as URL forwarders, they'd want that."

Business registration

Status: active · US

Registered to Google LLC via MarkMonitor Inc. Creation: 2019-01-08, Expires: 2027-01-08

Research summary

Narrative write-up from our AI analyst, grounded on the facts above

Our research confirms web.app is the official domain for Google Firebase Hosting, registered to Google LLC since 2019. Discussions on Reddit and cybersecurity forums note that while the platform is legitimate, attackers often use its free subdomains to host phishing pages because they inherit a sense of trust. There are no scam reports or complaints directed at the root domain or Google's operation of the service itself.

Antivirus Engines

Clean pass · verified

Clean across 92 engines

We cross-check every URL against our antivirus network of 92 malware and blacklist engines. None of them flagged this URL in the last scan.

0Malicious0Suspicious61Harmless92Engines

Clean

Kaspersky

Clean

Bitdefender

Clean

Microsoft

Not in pass

ESET-NOD32

Not in pass

Avira

Not in pass

Sophos

Clean

Fortinet

Clean

Google Safebrowsing

Clean

Emsisoft

Clean

No engine detections. The URL passed every antivirus and blacklist engine we queried in this scan. Stay vigilant — AV coverage is only one signal among many.

Security Scans

Blacklist Check

Not flagged on major threat lists

Checked against the major public blocklists used by browsers and security tools — no hits.

Contact Verification

We fetched the page and looked for real-world contact details. Legitimate businesses almost always publish an email on their own domain, a phone number, and a postal address. Scam shops usually don't.

What We Found

No clear contact details on the page

Emails on site's domainNone

Phone numbers46.4134 22

Postal addressNot listed

Linked social profiles0

Signal Summary

Several contact red flags

No contact email found anywhere on the page.
No postal address visible on the page.

Phone number listed (46.4134 22).

Domain & Encryption

Domain History

Age7 years old

RegistrarMarkMonitor Inc.

RegisteredJan 8, 2019

ExpiresJan 8, 2027

Owner privacyVisible

Encryption Certificate

StatusValid

ProtocolTLSv1.3

IssuerGoogle Trust Services · WR4

ExpiresAug 18, 2026 (59d)

Self-signedNo

Hosting & Technology

HostingGoogle LLC

Server locationUS

Web serverGoogle Frontend

PopularityTop 100k worldwide

Redirect Chain

Hops

Cross-domain

Yes

Lookalike

Punycode

1301http://web.app/
2301https://web.app/
3200https://firebase.google.com/products/hosting/cross-domain

Server Reputation

Abuse Intelligence

Confidence score0%

Reports on file59

ISPGoogle LLC

Usage typeContent Delivery Network

Still, stay alert

No major threat indicators — but a clean scan does not guarantee every page is safe, and phishing emails routinely spoof real domains.

Double-check the exact URL in your address bar
Confirm you are actually on web.app and not a lookalike like w-eb.app.com or an IDN homoglyph.
Use a password manager
Password managers only auto-fill on the exact domain they were saved for — they refuse to fill lookalike domains, which is the single best phishing defence.
Discuss this site on the forum
If you have first-hand experience with this site — good or bad — share it with the MalwareTips community.
Open

Reputation Sources

How this domain rates across independent threat-intelligence and blocklist providers.

Google Safe Browsing

Not listedCheck ↗

VirusTotal

Not listedCheck ↗

AbuseIPDB

Not listedCheck ↗

Also verify:Spamhaus ↗DNSBL / SURBL ↗PhishTank ↗

Referenced Domains

Outbound domains this page links to or loads resources from. Each links to its own security scan.

gstatic.com fonts.googleapis.com google-analytics.com firebase.google.com genkit.dev firebase.blog console.firebase.google.com

Safety FAQ

Common questions about this site, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.

Our automated security review found no threat indicators on web.app. The site appears legitimate based on the signals we checked, but always stay alert for phishing emails that spoof real domains.
web.app passed our automated security checks with a trust score of 93/100. No antivirus engines or major blacklists flagged the site at the time of the last scan.
Yes. web.app presents a valid TLSv1.3 certificate issued by Google Trust Services · WR4, expiring in 59 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.
web.app is 7.4 years old, registered on 1/8/2019 through MarkMonitor Inc.. Scam domains are often freshly registered — a site under 6 months old warrants extra caution.
No. All 92 antivirus engines in our malware network report web.app as clean.
No. web.app is not currently listed on the major browser blocklist feeds that modern browsers use.
web.app resolves to an IP operated by Google LLC in US (usage type: Content Delivery Network). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
Yes. web.app sits in the global top-100k on Cloudflare Radar, which means it has substantial real-world traffic. That does not automatically make it safe, but established brands almost always rank here and throwaway scam domains almost never do.

Final Verdict

Trust / 100

Final Verdict·web.app

SAFE

This is the official landing page for Google's Firebase Hosting service. It is a legitimate infrastructure platform used by developers to host websites and applications. You can safely browse this root domain.

You can safely use this site. If you encounter a specific link ending in '.web.app' that asks for passwords or payment info unexpectedly, treat that specific subdomain with caution.

AV engines

MT passes

Net signals

Scan another URL

Security review completemalwaretips.com/url-scan

Recently scanned

Other Safe reports

bluearenalmenorca.com

Community review

User reviews & comments(0)

Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.

Loading…

Loading comments…

This report is generated automatically by combining threat intelligence, domain signals, and an AI security analyst. It is informational, not legal advice. Always use your own judgement before sharing personal information or money online.