ScanMalware.com
Known malicious kithighphishing

Tax-refund and parcel-delivery phishing kit on Firebase Hosting (HR, SI, CY, GR, HU, FI, LV, LT, PL)

family: firebase-tax-postal-refund-2026-10
Short link:scanmalware.com/h/319

Phishing pages on Firebase Hosting subdomains (web.app and firebaseapp.com) that copy the page title and branding of national tax authorities offering a refund (Croatia, Slovenia, Cyprus, Finland, Latvia, Lithuania, Poland) and of postal services about a parcel (Greece, Hungary, Slovenia). One kit runs behind all of them: after the copied start page it asks for card number, expiry date and security code, then for one-time codes, and its scripts send what the visitor types to the operators through hard-coded Telegram bots or through relays hosted on Glitch. The same bots and relays appear on lures for different countries. This hunt matches pages carrying the known bot ids or relays, and pages on Firebase Hosting with one of the copied titles.

Anchors

SMQL queryrun
telegram_bot:5299500415 OR telegram_bot:5545422297 OR telegram_bot:5297340772 OR telegram_bot:5630232532 OR telegram_bot:5733429658 OR telegram_bot:5864562419 OR telegram_bot:6723937202 OR js_text_host:aspiring-voracious-anthropology.glitch.me OR js_text_host:melted-substantial-wood.glitch.me OR ((title:"Porežna Uprava - UPRAVA ZA FINANCIJSKI POVRAT RH" OR title:"Vračilo davka - FINANČNA UPRAVA REPUBLIKE SLOVENIJE" OR title:"Pošta Slovenije" OR title:"Τμήμα Φορολογίας | Επιστροφή χρημάτων" OR title:"ΕΛΤΑ - Αποστολή πακέτων" OR title:"Magyar Posta Zrt. - Nyitó" OR title:"Henkilöasiakkaat - vero.fi" OR title:"VID EDS - Elektroniskās deklarēšanas sistēma" OR title:"Prisijunkite prie VMI grąžinimo sistemų") AND (domain:*.web.app OR domain:*.firebaseapp.com))

Provenance

Added: 2026-10-29 17:38
Entry points are short-lived Firebase projects, each usually published on both web.app and firebaseapp.com, for example porezna-uprava-82a29[.]web[.]app, edavki-refund[.]firebaseapp[.]com, mof-gov[.]web[.]app, elta-postal[.]firebaseapp[.]com, vero-suomi[.]web[.]app, vid-lv-eds[.]firebaseapp[.]com and puesc-kas[.]web[.]app. The relays are aspiring-voracious-anthropology[.]glitch[.]me and melted-substantial-wood[.]glitch[.]me. New countries appear under new titles; the bot ids and the relays are the links that carry over.

Sightings (118)Atom feed

HostScanScriptMatchScanned
puesc-kas.firebaseapp.comdb76d79a…—query2026-10-29 18:51
puesc-kas.web.appfba6516a…—query2026-10-29 18:50
sti-vmi-7e921.firebaseapp.com1aa74274…—query2026-10-29 17:50
sti-vmi-7e921.web.appca96a97d…—query2026-10-29 17:50
vid-latvija.firebaseapp.come276c18a…—query2026-10-29 07:53
vid-latvija.web.appa3448468…—query2026-10-29 06:54
vid-lv-eds.web.app66505e58…—query2026-10-28 05:51
vid-lv-eds.firebaseapp.comfdb20118…—query2026-10-28 05:51
omavero-fi.firebaseapp.com865350ff…—query2026-10-28 02:54
omavero-fi.web.appf8a3c032…—query2026-10-28 02:54
edavki-durs.firebaseapp.com82af414c…—query2026-10-27 22:55
edavki-durs.web.appf0644903…—query2026-10-27 22:55
edavki-refund.firebaseapp.come209863a…—query2026-10-27 21:56
edavki-refund.web.app072d593c…—query2026-10-27 21:56
elta-postal.firebaseapp.comd3be0aa7…—query2026-10-27 20:55
elta-postal.web.appdac45d65…—query2026-10-27 20:55
edavki-depozit.firebaseapp.com13d1d775…—query2026-10-27 20:55
edavki-depozit.web.app9bab86eb…—query2026-10-27 20:55
posta-d5012.firebaseapp.combaaf9b74…—query2026-10-27 19:56
posta-d5012.web.app33364cf5…—query2026-10-27 19:56
postia-slovenija.firebaseapp.com14160dbe…—query2026-10-27 19:55
postia-slovenija.web.appfdab12da…—query2026-10-27 19:55
eltapackage.firebaseapp.comcba035d0…—query2026-10-27 19:55
eltapackage.web.app4f35e9cb…—query2026-10-27 19:54
uprava-eporezna.firebaseapp.com4cba7f66…—query2026-10-27 18:57
uprava-eporezna.web.appfd1a7540…—query2026-10-27 18:57
porezna-upirava.firebaseapp.com18b4d70a…—query2026-10-27 18:55
porezna-upirava.web.app78ced450…—query2026-10-27 18:55
mof-gov.firebaseapp.com356c8344…—query2026-10-27 18:55
mof-gov.web.appea32a908…—query2026-10-27 18:55
invoice-elta.firebaseapp.com9f7e4d7d…—query2026-10-27 13:56
invoice-elta.web.app557a4a1b…—query2026-10-27 13:55
porezna-uprava-82a29.firebaseapp.com1d5d77ee…—query2026-10-27 07:56
porezna-uprava-82a29.web.appb47d9912…—query2026-10-27 07:56
porezna-uprava-23b83.firebaseapp.come93becbe…—query2026-10-27 07:55
porezna-uprava-23b83.web.appaa90f1df…—query2026-10-27 07:55
porezna-uprava-9d4fd.firebaseapp.com6314f39d…—query2026-10-27 06:57
porezna-uprava-9d4fd.web.appeb090a94…—query2026-10-27 06:57
porezna-uprava-5e120.firebaseapp.com88c33d85…—query2026-10-27 06:55
porezna-uprava-5e120.web.app831e2ebd…—query2026-10-27 06:55
porezna-uprava-f0415.firebaseapp.com437929d8…—query2026-10-27 05:57
porezna-uprava-f0415.web.app9d332d4c…—query2026-10-27 05:57
porezna-uprava-8f75b.firebaseapp.com34ab4f8c…—query2026-10-27 05:57
porezna-uprava-8f75b.web.appf3bab1c3…—query2026-10-27 05:56
porezna-uprava-4b978.firebaseapp.com5e864a07…—query2026-10-27 05:56
porezna-uprava-4b978.web.appbf13c942…—query2026-10-27 05:56
megyar-post.firebaseapp.com86936838…—query2026-10-27 01:56
megyar-post.web.app137083fb…—query2026-10-27 01:56
edavki-portal.firebaseapp.com6befa576…—query2026-10-26 18:53
edavki-portal.web.app240f9085…—query2026-10-26 16:54
porezna-uperava.firebaseapp.com7debc436…—query2026-10-26 12:56
porezna-uperava.web.app2b81eaae…—query2026-10-26 12:56
povrat-poreza.firebaseapp.comc0669388…—query2026-10-26 10:55
povrat-poreza.web.appe5c0eef4…—query2026-10-26 10:55
vmi-mysti.firebaseapp.comd7d056f0…—query2026-10-26 07:54
vmi-mysti.web.appef8696e8…—query2026-10-26 07:54
mof-gov-cac43.firebaseapp.com21fe789d…—query2026-10-26 05:55
mof-gov-cac43.web.appb6506178…—query2026-10-26 05:55
mof-gov-71fd1.firebaseapp.com6041b078…—query2026-10-26 04:56
mof-gov-71fd1.web.appdaa84c26…—query2026-10-26 04:56
cmi-clt.firebaseapp.com722bbe70…—query2026-10-25 21:51
cmi-clt.web.app45a15e04…—query2026-10-25 21:51
mof-gov-9042e.firebaseapp.com557384cc…—query2026-10-25 17:55
mof-gov-9042e.web.app6acdc9eb…—query2026-10-25 17:55
vid-lv.firebaseapp.come40cc7bb…—query2026-10-25 15:55
vid-lv.web.appb9d1fffa…—query2026-10-25 15:55
vero-suomi.firebaseapp.com7358941e…—query2026-10-25 14:52
vero-suomi.web.app1327a296…—query2026-10-25 14:52
vero-omavero.firebaseapp.combb556379…—query2026-10-25 09:51
vero-omavero.web.app76b2954c…—query2026-10-25 09:51
omavero-gov.firebaseapp.com5ad1ef6a…—query2026-10-24 08:53
omavero-gov.web.app9a1935f5…—query2026-10-24 08:53
vero-fi-bfb14.firebaseapp.comec89c6e0…—query2026-10-24 06:54
vero-fi-bfb14.web.appe85f4e54…—query2026-10-24 06:54
edavki-8a186.firebaseapp.coma0e69a8f…—query2026-10-24 06:53
edavki-8a186.web.app7139e1e7…—query2026-10-24 06:53
myvmi-sti.firebaseapp.com4f58457f…—query2026-10-23 14:50
myvmi-sti.web.appeddc3d5b…—query2026-10-23 14:50
gov-vid.firebaseapp.combf3bd1d7…—query2026-10-23 06:53
gov-vid.web.appd22f9b6a…—query2026-10-23 06:52
mans-vid.firebaseapp.comcfc590e2…—query2026-10-23 03:51
mans-vid.web.app5f8857d9…—query2026-10-23 03:51
puesc-kas.firebaseapp.com4cbc2fe5…—query2026-10-22 17:51
puesc-kas.web.app474176a9…—query2026-10-22 17:50
sti-vmi-7e921.firebaseapp.com9c35944f…—query2026-10-22 16:50
sti-vmi-7e921.web.appc3552e43…—query2026-10-22 16:50
vid-latvija.firebaseapp.coma7c4cc1c…—query2026-10-22 06:54
vid-latvija.web.appb8bdd074…—query2026-10-22 05:54
vid-lv-eds.web.app7c0fa020…—query2026-10-21 04:51
vid-lv-eds.firebaseapp.com3effdfce…—query2026-10-21 04:51
omavero-fi.firebaseapp.comff766c90…—query2026-10-21 01:54
omavero-fi.web.app11ed8692…—query2026-10-21 01:54
edavki-portal.firebaseapp.com537f613f…—query2026-10-19 17:54
edavki-portal.web.app2fba006e…—query2026-10-19 15:54
cmi-clt.firebaseapp.com5d68f32a…—query2026-10-18 20:51
cmi-clt.web.app1aa09b0e…—query2026-10-18 20:51
vero-suomi.firebaseapp.com8fd6a652…—query2026-10-18 13:52
vero-suomi.web.appe6a6b6f2…—query2026-10-18 13:52
vid-lv-eds.web.app50c22478…—query2026-10-14 03:52
vid-lv-eds.firebaseapp.com7c097c2f…—query2026-10-14 03:52
edavki-portal.firebaseapp.com0e3feb0d…—query2026-10-12 16:54
edavki-portal.web.app7fbaffd8…—query2026-10-12 14:55
cmi-clt.firebaseapp.com4fe62996…—query2026-10-11 19:52
cmi-clt.web.app2909d7ad…—query2026-10-11 19:51
vero-suomi.firebaseapp.comf9944562…—query2026-10-11 12:53
vero-suomi.web.appcf09011a…—query2026-10-11 12:53
vid-lv-eds.web.appb0246eb8…—query2026-10-07 01:52
vid-lv-eds.firebaseapp.comafbca991…—query2026-10-07 01:52
cmi-clt.firebaseapp.com0b63e800…—query2026-10-04 18:52
cmi-clt.web.app504d88fb…—query2026-10-04 18:52
vero-suomi.firebaseapp.com840b3016…—query2026-10-04 11:52
vero-suomi.web.app249e9f54…—query2026-10-04 11:52
vid-lv-eds.web.app6cea7ba4…—query2026-09-30 00:53
vid-lv-eds.firebaseapp.com33b3bfe3…—query2026-09-30 00:53
cmi-clt.firebaseapp.com0ce7641f…—query2026-09-27 17:52
cmi-clt.web.appaac13fb6…—query2026-09-27 17:52
vero-suomi.firebaseapp.com804afde6…—query2026-09-27 10:50
vero-suomi.web.app51cdc6e8…—query2026-09-27 10:50