Firebase Hosting redirect pages into Codeanywhere containers: bank, post, customs and tax phishing across Europe

Throwaway Firebase Hosting sites (web.app and firebaseapp.com) whose only content is an instant meta-refresh redirect into a Codeanywhere development container (<name><digits>.codeanyapp.com), where the phishing pages run. The entry site's name carries the target, and the path inside the container usually names it again: Swedbank, Swish, MitID and MobilePay, SpareBank 1, Norwegian BankID, DHL, Deutsche Post and Postbank, German and Norwegian customs, Bank of Cyprus, VUB, Bank of Valletta, Santander Portugal, the Icelandic and Latvian postal services and others. Each entry site is usually published under both web.app and firebaseapp.com, sometimes behind a disq.us link redirect, and one container account serves several brands. The redirect page copies no branding, so this hunt keys on the redirect itself: the hunting rule matches a redirect-only page that sends the visitor into a codeanyapp.com host, and the search anchor matches scans that start on Firebase Hosting and end on a Codeanywhere host.