That Firebase Storage Link in Your Email Is Phishing

An email says your mailbox is almost full, or that you have a secure document waiting. You click the link and land on a login page. The web address starts with firebasestorage.googleapis.com, and you think, "That is Google, so it must be safe." That is exactly what the scammer is counting on. The address really does belong to Google, but the page sitting on it may have been uploaded by a criminal.

At The Scam Exposed, readers have reported links on this hostname, and those reports led us to dig into what security researchers have actually documented. The answer is nuanced, and it matters. Firebase Storage is a legitimate Google service used by thousands of apps. At the same time, there are several documented cases of criminals using specific Firebase Storage links to host phishing pages that steal email passwords, bank details and one time codes.

This guide explains what the service is, what the evidence shows, how these phishing attacks work, how to check any link in under a minute, and what to do if you already typed in your password.

What is firebasestorage.googleapis.com?

Firebase is a set of cloud tools from Google that developers use to build apps and websites. One part, Cloud Storage for Firebase, lets apps store and share files such as photos, videos, PDFs and documents. Google's official documentation lists firebasestorage.googleapis.com as the service endpoint for that storage system.

When an app saves a file to Firebase Storage, the file gets a web address on that hostname. Anyone with the link can usually open it. That is useful for legitimate apps: a fitness app might store your profile picture there, or a company might share a product manual.

The same feature is what makes it attractive to scammers. Anyone can create a free Firebase project, upload a file such as an HTML web page, and get a link that starts with a trusted Google hostname. The service does not check whether that HTML page is a fake login form before it goes live.

So the domain itself is not a phishing website. It is shared infrastructure, like a giant public storage building. Most lockers hold ordinary things. A few hold something dangerous. The address on the outside of the building tells you nothing about what is inside a particular locker.

The evidence: documented phishing cases

Several independent security sources have recorded specific Firebase Storage links being used in phishing. Each finding applies to the exact link analyzed, not the whole service.

The fake webmail login (URLQuery)

On August 8, 2025, the scanning service URLQuery analyzed a page hosted on firebasestorage.googleapis.com. It was titled "Webmail Login," tagged as phishing, and matched a known phishing kit. In plain terms, someone uploaded a ready made fake login page to Firebase and sent people the link.

The Zimbra campaign (CSIRT Toscana)

On August 20, 2025, the regional cybersecurity team CSIRT Toscana published an advisory about a phishing campaign impersonating Zimbra, an email system used by many businesses, schools and government offices. Two Firebase Storage links pointing to HTML files were listed as indicators of compromise. The emails used a display name, "Z!mbra Service," and asked recipients to confirm their email identity. This is one of the clearest documented examples of Firebase Storage being used in a real campaign.

A malicious verdict (ANY.RUN)

On October 28, 2025, the malware sandbox ANY.RUN published an analysis of a Firebase Storage URL that received a "malicious activity" verdict and a phishing tag.

Another Zimbra impersonation (SafeMode)

On May 22, 2026, SafeMode recorded another Firebase Storage page impersonating Zimbra, with a 95 percent confidence score for the brand identified. The same theme showing up months apart suggests that Firebase hosted Zimbra lures remain in use.

India's 2026 crackdown on Firebase abuse

The problem goes beyond individual scans. In August 2026, India's Indian Cyber Crime Coordination Centre, known as I4C, directed Google to remove at least 57 websites and databases hosted on Firebase, Reuters reported. Government notices described them as being used to spread malware or collect sensitive financial information.

Seven of those sites were described as phishing pages impersonating major Indian banks, including State Bank of India, ICICI Bank and Axis Bank. Reuters also noted that the notices did not suggest Google or Firebase was responsible for the scams.

One limit is important: the reporting does not establish that all 57 cases used the firebasestorage.googleapis.com hostname specifically. Firebase offers several hosting and database services. Still, the action shows that governments are seeing a pattern of criminals using Firebase infrastructure, and that the pattern reaches bank customers, not only email users.

Why scammers use Google's infrastructure

Criminals use trusted cloud services for the same reasons legitimate developers do, plus a few of their own.

• Borrowed trust. A link that contains "googleapis.com" looks safer to ordinary users than a strange new domain.
• Getting past email filters. Many spam and security filters treat big cloud providers more gently than unknown sites, because blocking them would also block legitimate business email.
• Free and fast. A Firebase project can be created in minutes at no cost, and a new link can be uploaded as soon as an old one is taken down.
• Secure padlock. The link uses HTTPS, so browsers show a padlock. Many people still believe the padlock means "safe site," but it only means the connection is encrypted.
• Hard to block entirely. Companies cannot simply block the whole hostname without breaking apps their employees use.

The same trick is used with other trusted platforms, including Google Docs, Google Forms, Microsoft SharePoint, Dropbox and file sharing sites. Our guide to the Zimbra zero click phishing warning shows how email systems like Zimbra are a frequent target.

How a Firebase phishing attack works, step by step

Step 1: The lure

You receive an email or text. Common themes include "Your mailbox is full," "Your password expires today," "You have a pending secure document," "Invoice attached," "Voicemail received" or "Your bank account has been limited." The message uses a company logo and an urgent tone.

Step 2: The link

The button or link points to a long address beginning with firebasestorage.googleapis.com, followed by a project name and a file path ending in something like .html. Some emails hide it behind a button, so you only see the address after clicking.

Step 3: The fake login page

The page looks like your email provider, Microsoft 365, Zimbra, your bank or a document viewer. It may even fill in your email address automatically from the link, which makes it feel personal and real.

Step 4: The theft

When you type your password, it is sent to the criminal. Some pages show an error and ask you to try again, collecting your password twice to make sure it is correct. Others then ask for a one time code, a card number or answers to security questions.

Step 5: The takeover

The criminal logs into your real account, often within minutes. With email access, they can reset passwords for other accounts, read private messages, send phishing emails to your contacts, or watch for invoices and change bank details to steal payments.

A typical case, start to finish

This example follows the patterns in the security reports above and our readers' reports. The details are typical rather than taken from one single victim.

A school office manager receives an email from "Z!mbra Service" saying her mailbox will be suspended in 24 hours unless she confirms her account. The link opens a clean, professional page with the Zimbra logo and her email address already filled in. She notices the address contains googleapis.com and assumes it is a Google security check. She enters her password.

The page says "Incorrect password, please try again," so she types it again. Then it shows "Account verified" and sends her to the real Zimbra login. Everything seems fine.

That night, the attacker logs into her real mailbox and sends a fake invoice email to every parent in her contacts, from her genuine address. Several parents click. By morning, the school's IT team is resetting dozens of accounts. It all started with one link on a trusted Google hostname.

The lure messages we see most often

Phishing pages on Firebase are only half of the trick. The other half is the message that gets you to click. These are the themes that appear again and again in security reports and in the messages our readers forward to us.

"Your mailbox is full"

The email says you have reached your storage limit and new messages will bounce unless you "upgrade" or "validate" your account. It often shows a fake storage bar at 98 or 99 percent. Real email providers show storage warnings inside your inbox settings, not through links to outside pages.

"Your password expires today"

The message claims your password is about to expire and offers a button to "keep the same password." That wording is a giveaway. No legitimate system lets you keep an expiring password by logging in through an email link.

"You have a secure document"

The email looks like a file sharing notice from DocuSign, OneDrive, Dropbox or an accountant, saying a contract, invoice or tax form is waiting. Clicking leads to a page asking you to sign in to view it. If you were not expecting a document, contact the sender by phone before opening anything.

"Voicemail received"

A message says you have a new voicemail or fax and must log in to listen. Phone systems that send voicemails by email usually attach the audio file directly.

"Unusual sign in activity" or "account limited"

Bank and payment themed messages say your account was locked after suspicious activity. The Firebase page then copies the bank's login and asks for your card number and one time code too. These are the type India's I4C flagged when it ordered Firebase sites impersonating major banks removed.

"Delivery problem" texts

Text messages claim a package could not be delivered and link to a page asking for a small redelivery fee. Sometimes the page is hosted on cloud storage. Our guide to the unpaid toll text scam covers a closely related text message trick.

Every theme shares the same structure: a believable problem, a deadline, and a link to a page that asks for something private. Learning the structure protects you better than memorizing any one message.

Red flags on a Firebase link

• A login page on firebasestorage.googleapis.com. Real email providers and banks host their login pages on their own domains.
• A link that ends in .html after a long string of characters and a project name.
• It asks for your email or bank password, card number or one time code.
• It arrived in an unexpected email or text, especially about storage, passwords, invoices or voicemails.
• Urgency: account suspension, password expiry or "act within 24 hours."
• Odd spelling in the sender name, such as "Z!mbra" or "Micros0ft."
• Your email address is pre-filled on the page, which phishing kits do automatically.
• A first attempt fails and asks you to retype your password.
• Branding that does not quite match the official company website.

Legitimate Firebase file vs phishing page

How to check a link before you click

1. Hover or long press. On a computer, hover your mouse over the link to see the real address. On a phone, press and hold the link.
2. Read the address from right to left of the first slash. The part just before the first single slash is the real host. For a bank, it should be the bank's own domain.
3. Ask: does this company host logins here? Your bank, Microsoft, Zimbra and your employer do not host their login pages on firebasestorage.googleapis.com.
4. Do not click to test it. Instead, open the service in a new tab by typing its address or using its app, and check whether there really is a problem.
5. Use a scanner if needed. Free tools from reputable security companies can analyze a link without you opening it. Remember that a clean result is not a guarantee.
6. Check it on our site. You can search a suspicious website in our scam lookup to see whether others have reported it.

What the evidence does not show

Being accurate matters, especially on a site people use to decide whether something is dangerous. These claims are not supported by the evidence:

• "Firebase Storage is a phishing website." It is a legitimate Google service.
• "Every firebasestorage.googleapis.com link is dangerous." Many legitimate apps use it every day. Each link must be judged on its own content.
• "Google created these phishing pages." The evidence points to third parties abusing the service. Reuters noted that India's notices did not blame Google or Firebase.
• "All these cases are one campaign." The reports cover different links, dates, researchers and targets. They show repeated abuse, not a single group.

Our own public alert for this hostname has recorded a small number of phishing complaints. That small number is a warning signal, not proof that the entire hostname is malicious. Independent security reports provide stronger evidence that specific links were used for phishing.

How to protect yourself and your family

1. Turn on two step verification for your email, bank and social media. Prefer an authenticator app or passkey over text messages.
2. Use a password manager. It fills passwords only on the real site, so it will not autofill on a fake page. That is a useful warning.
3. Never reuse passwords. One stolen email password should not unlock your bank.
4. Treat storage, password and invoice emails with suspicion, especially when they create urgency.
5. Keep your browser updated and leave its safe browsing protection switched on.
6. Talk to older relatives about the padlock myth. A padlock means encrypted, not safe. Our free printable scam safety card is an easy reminder.

Advice for businesses and email admins

Organizations using Zimbra, Microsoft 365 or Google Workspace are frequent targets of Firebase hosted lures.

• Train staff that login pages should only appear on your own domains, and share real examples of these lures.
• Configure email security to flag messages linking to cloud storage HTML files, rather than blocking the entire hostname.
• Enforce multi factor authentication, ideally phishing resistant methods such as passkeys or security keys.
• Watch for unusual logins, new mail forwarding rules and mass outgoing emails, which often follow a stolen password.
• Report malicious Firebase links to Google so they can be taken down quickly, and share indicators with your sector's security community.

Already entered your details? Do this now

1. Change the password immediately on the real website or app, not through any link in the email.
2. Change it anywhere else you used the same password.
3. Turn on two step verification and sign out of all other sessions from your account security settings.
4. Check for forwarding rules and filters in your email settings. Attackers often add rules to hide replies or copy your mail.
5. If you entered bank or card details, call your bank using the number on your card and ask them to block the card and watch for fraud.
6. If you entered a one time code, contact the affected service right away. The code may already have been used.
7. Warn your contacts if the attacker may have emailed them from your account.
8. If you downloaded a file, do not open it. Run a full scan with your security software or get help from a trusted technician.

Our guide to the first 48 hours after a scam and our fraud help resources page list more steps and official contacts.

How to report a Firebase phishing link

• To Google: report the page through Google's phishing report form or Safe Browsing report tool, including the full Firebase URL.
• To the FTC: file at ReportFraud.ftc.gov.
• To the FBI: if you lost money or data, file at IC3.gov.
• To your email provider: use the "Report phishing" button so filters learn from it.
• To the impersonated company: banks and email providers have phishing report addresses on their websites.
• To us: you can report the scam you ran into so the next person sees a warning.

Frequently asked questions

How we researched this article

This article is based on Google's Firebase documentation, independent security analyses from URLQuery, CSIRT Toscana, ANY.RUN and SafeMode, Reuters reporting on India's I4C notices, and reports submitted to The Scam Exposed. Every finding links to its original source and applies only to the specific URLs analyzed. We do not accept payment from any company mentioned here. If you spot an error, please email [email protected] and we will review it under our fact checking policy.

This article is for general consumer education and is not legal or technical advice. If your organization was targeted, contact your IT or security team.

For the full checklist, read our guide on how to spot phishing emails.