4 Firebase Projects, 410 Reply Addresses, 1 Operator
A reply-harvesting phishing operation, traced from Firebase to a Hetzner VPS in Falkenstein
TLDR
4 Firebase hosted Facebook “account blocked” lures all identical template, identical 410 address reply pile, 4 burner Firebase projects = single operator
3 CTAs (Report the user / Yes, me / Unsubscribe) all mailto: to the same pile
410 reply addresses to 138 unique registrable domains
86% Namecheap, 75% default DNS, 75% Namecheap email forwarding, bulk registered reply sinks
11 of 138 pointed at
okinawazones[.]net, which resolves to a single Hetzner VPS in Falkenstein1 of 22 cert-bearing domains (
ikramedia[.]web[.]id) lit up the same Hetzner IP, DNS pivot and cert pivot land on the same boxOperator likely Indonesian, running since 2016, with MENA-targeted Arabic content sites as parallel product lines
Defanged IOCs + hunt queries at the bottom
The Lure
I often hunt my inbox for practice. I searched through my inbox and found a “Your Account is Temporarily Blocked” email, I didn’t think too much about it till I saw three others. All similar in who they are from.
Facebook@setup4-490214.firebaseapp.comFacebook@frog2-490619.firebaseapp.comFacebook@focus-electron-490811-r5.firebaseapp.comFacebook@dahlia8-490915.firebaseapp.com
All with the subject line “Your Account is Temporary Blocked (Critical Login Attempt) Please Verification is NEEDED”
Initially I thought, no big deal its only Facebook. Then I thought, well I may not be the only one to have gotten this, plus I am super bored so lets dig in.
The Email
Right away we know this email is not really from Facebook. The easiest giveaway was the From email.
The subject line is “Your Account is Temporary Blocked (Critical Login Attempt) Please Verification is NEEDED” the normal urgency that is seen across most phishing campaigns.
This email has 3 call to action buttons that can be observed.
Report the user
Yes, me
unsubscribe
I wanted to see what would happen if I click on the buttons so I open the email up and investigate deeper.
MailTo:
Both ‘Report the user’ and ‘Yes, me’ send to the same 410 address pile, with pre-filled subject and body. Unsubscribe goes to the same pile.
All four bodies carry the exact same 410 address reply pile (every one starts with all@yupfamilly.org.uk), and originate from Google’s outbound SMTP (209.85.220.69, expected for Firebase sent mail). Different Firebase projects, same operator reusing the same payload.
410 down to 138: the reply-sink layer
If I have to see this giant wall of text so do you.
I’ve have some scripts available on my github for anyone who wants to alter for similar triaging.
The script pulls 410 addresses to base domains (each domain used as 3 prefixes: info@info.X, support@X, contact@contact.X), leaving 138 unique registrable domains. Ran WHOIS + DNS (NS, MX) on each.
Findings:
86% Namecheap registered (119 of 138). Multiple WHOIS label formats (
NameCheap, Inc.,NAMECHEAP INC) same registrar, one account buying in bulk.75% on default Namecheap DNS (
dns1/dns2.registrar-servers.com, 123 of 138). Attacker kept the default DNS config.75% using Namecheap email forwarding (
eforward1–5.registrar-servers.com, 103 of 138). Shared free mail-forwarding service. Victim replies across 103 domains all funnel through Namecheap’s forwarder to a small set of destination mailboxes.Creation-date waves: 2020-05 (18), 2020-07 (20), 2020-11 (37), 2021-01 (20). Bulk registration behavior.
138 domains appear to be coordinated infrastructure.
Two threads
Thread 1 — DNS pivot
11 domains use okinawazones[.]net as their nameserver and that domain resolves to 148.251.79[.]3 (Hetzner, Falkenstein).
In Shodan that domain shows us a full cPanel hostnames, and the techstack of Nginx for a reverse proxy and Nginx with OpenResty as Web Servers.
Virus Total shows passive DNS list of 68 hostnames, filtered down to 3 operator linked sites (apkmoro[.]com, voxtee[.]com, tyuete[.]com) these were Arabic language piracy / game cheats / scam directory.
Thread 2 — Cert pivot
22 of 138 had cert history. ikramedia[.]web[.]id stood out the most to me immediately due to its sheer number of certs: 114 certs, 25 subdomains, active 2016 to 2026. The cpanel.site hostname (ikramedia.web.id.148.251.79.3.cpanel.site) explicitly ties it to the same Hetzner IP.
Coming Together
Both pivots landed on
148.251.79[.]3. DNS got there, certs got there. Same box from two angles is operator infrastructure. Everything else is disposable.
Three-layer model
Outer layer — phishing product (what victims see):
4 Firebase projects deliver identical lures
410 recipients across 3 CTA buttons, all identical
138 base domains acting as disposable reply sinks
Mail flows back via Namecheap eforward infrastructure
Entire layer designed to be burned and rebuilt
Middle layer — discovery pivot (how the investigation bridged):
okinawazones.net is a nameserver, not a domain the victim ever sees
Used by 11 of 138 sink domains
Resolving it points to a single IP
Without this thread, the outer and inner layers would not be connectable from public data
Inner layer — operator infrastructure (what’s actually running):
One Hetzner VPS in Falkenstein, Germany
cPanel + Exim/Dovecot mail + PowerDNS + nginx/WordPress
Primary domain
ikramedia.web.id, active since 2016, Indonesian-language3 Arabic content sites as parallel product lines (piracy, game cheats, scam directory) targeting MENA audiences
Terminates mail for all 103 eforward-routed sink domains
Attribution signals
Operator likely Indonesian:
.web.idprimary domain, Indonesian subdomain names (produk,kebonkopi,masjidalbasfar,akademik1), operation running since 2016Targets MENA: Arabic-language content sites, Moroccan-sounding reply-destination domain (
mazguiti.com), Arabic phishing lures distinguished from Indonesian-facing content sitesModest operational security: single VPS, no redundancy, cPanel defaults exposed, cheap shared infrastructure at every layer
Multi-year, multi-product: Facebook reply-harvesting phishing is the newest line (2026) layered on top of a long-running hosting + content operation
Detections
Two Sigma rules covering inbound Firebase sender mail with mass mailto bodies, and outbound replies routing through Namecheap eforward.
Experimental, not tuned currently working on my Sigma skills https://github.com/inf0stache/threat-detections/tree/main/sigma
IOCs (defanged)
IP:
148.251.79[.]3Nameserver:
okinawazones[.]netOperator domains:
ikramedia[.]web[.]id,apkmoro[.]com,voxtee[.]com,tyuete[.]comReply-destination outlier:
mazguiti[.]comFirebase sender patterns:
*.firebaseapp[.]comFull 138 domain list + scripts: https://github.com/inf0stache/threat-detections/tree/main/evidence/firebase-mass-reply-sink
Closing note
I'm going to keep pulling on this thread. A few things I didn't chase in this post: what's actually hosted on the 3 Arabic sites, who the replies ultimately land with (the eforward chain terminates somewhere), and whether the operator's 2016 era infrastructure has older campaigns worth digging up. Part two when I have it.