I4C Targets 149 More Firebase Hosts Used in PM-KISAN, Bank and RTO Scam Apps

NEW DELHI, Oct 29 - India's Indian Cyber Crime Coordination Centre (I4C), under the Ministry of Home Affairs (MHA), has sent Google three more takedown notices naming 149 Firebase Realtime Database hosts, the latest in a run of orders against databases used as back ends for Android malware that steals one-time passwords (OTPs) and SMS messages, according to copies published on the Lumen Database.

The notices, each titled "Government Request Removal Complaint to Google", were sent on Oct. 22, Oct. 23 and Oct. 26, 2026 and submitted to Lumen by Google LLC, the recipient. Lumen numbers them 100795192, 101418971 and 101418978. The sender is listed as "I4C" on the first and "I4C - MHA" on the other two, with jurisdiction India. Lumen, run by Harvard's Berkman Klein Center, publishes government removal requests that Google shares voluntarily. Its public pages show each target's hostname but withhold the full URLs, which are available only on request.

This is the latest in a series of disclosed I4C Firebase takedowns. Earlier notices covered at least 57 assets in August, 216 Realtime Databases in a single day on Sept. 20 and 174 unique targets in notices dated Oct. 1 and Oct. 9. None of the 149 hosts listed below appears in the earlier 174-target list.

By the Numbers

The 158 listings less 9 repeats give 149 unique hosts. Of the 15 hosts in the Oct. 26 notice, eight had already been named in an earlier notice, including six from three days before.

How the Scheme Works

Firebase Realtime Database is a Google-hosted cloud database that app developers use to store and sync data without running their own servers. Criminal groups have been using free projects on it as command-and-control and data-drop servers. There is no suggestion in the notices that Google is at fault. The targets are projects created by third parties.

The three new notices give no explanation. The pattern described in earlier I4C notices and media reports runs as follows:

1. Lure: an SMS or social media message offers a PM-KISAN payment, an RTO traffic challan, a bank update or a courier delivery and asks the victim to install an app.
2. Sideload: the victim installs an APK file from outside the Play Store.
3. Permissions: the app asks for SMS access, such as RECEIVE_SMS and READ_SMS, and in many cases Accessibility and notification access.
4. Exfiltration: incoming SMS messages, including bank OTPs, are sent to the operator's Firebase database over HTTPS.
5. Cash-out: the operator uses the OTPs to complete transactions before they expire.

Because the traffic goes to Google domains (firebaseio.com and firebasedatabase.app), it can be harder for network filters to tell apart from legitimate app traffic.

What the Database Names Show

The project names chosen by operators point to scam themes and to the use of ready-made admin "panels". The groupings below are based on the hostnames alone. The notices themselves do not say what each database was used for.

1. Welfare-scheme and RTO lures (9 hosts)

Eight hosts use PM-KISAN, the federal income-support scheme for farmers, or close spellings of it:

• pm-kisan-11hcg-default-rtdb.firebaseio.com
• pm-kisan-12hfg-default-rtdb.firebaseio.com
• pm-kisan-25fyg-default-rtdb.firebaseio.com
• pm-kisan2-20361-default-rtdb.firebaseio.com
• pm-kishan-24bugf-default-rtdb.firebaseio.com
• pm348-4dca3-default-rtdb.firebaseio.com
• pmkisan2-c1211-default-rtdb.firebaseio.com
• pmkishan16-b178b-default-rtdb.firebaseio.com

A ninth, new-rto-dev04-default-rtdb.firebaseio.com, refers to the Regional Transport Office, consistent with the fake traffic-fine apps seen in earlier campaigns.

2. Bank names and carding terms (5 hosts)

• HDFC Bank name: a-comp-hdfc-apcd006-default-rtdb.firebaseio.com
• ICICI Bank name, with "kolkata" in the project name: icici-kolkata-apcd001-default-rtdb.firebaseio.com
• India Post Payments Bank name: ippb-ka-system-default-rtdb.firebaseio.com
• Carding and account-selling terms: john-carder-default-rtdb.firebaseio.com and id-selling-f67fe-default-rtdb.firebaseio.com

The HDFC and ICICI hosts appear in both the Oct. 23 and Oct. 26 notices.

3. Admin panels (20 hosts)

Twenty hosts contain "panel", its misspellings "penal" and "panal", or "admin", which suggests operator dashboards from phishing or malware kits. They include yamraj-panel-setup (Yamraj is the Hindu god of death), monika-admin-panal, punj-admin-panel, puja-admin-panel-30a82, purple-panel-56a96, mera-penal, renal-penal, motte-admin, lodakapanel1 and londa-panel-bc1e2, plus numbered series such as my-admin-06, my-admin-08, my-admin-10, my-admin-50, panel-11th, panel-2-a3006, panel-4aa3d, panel-60588, admin-c3805 and newadmin-d5116.

4. "PIN nahi aaya" (1 host)

pin-nhi-aaya-default-rtdb.firebaseio.com appears to mean "PIN did not arrive" in Hindi. That could refer to an OTP that failed to come through, but the notices do not explain how the database was used.

5. Adult-themed names (2 hosts)

sexyvideo-42aa2-default-rtdb.firebaseio.com and hydra-sex-default-rtdb.firebaseio.com use adult-content names, a lure seen in other Android malware campaigns. Their actual use is not stated in the notices.

6. Personal names, celebrities and slang (most remaining hosts)

Most of the other hosts carry personal names, nicknames, celebrity references or random strings. They point to small, often Hindi-speaking operators rather than one organised brand.

• Celebrity and cricket references: ms-dhoni-26060, dhoni26, amitabh-385d6
• Personal and regional names: bihari-653c9, mukeshbhaids, munna-jija-ji, kamlusinghaniya-f05d5, pujakumari2211-ac3ab, kumarraj-6886e, priyanshu-4d425
• Hindi words: sabhojayega-e0558 appears to mean "everything will get done" and jadugar-e2f73 appears to mean "magician"
• Crude or abusive Hindi slang, listed only as hostnames: bharwa-5fa4b, pagal-8c47e, lodaajjurandj, nunu-14cf2, landu-540e4

Indicators of Compromise

The 149 unique hosts below are listed exactly as they appear in Lumen notices 100795192, 101418971 and 101418978. The notices do not record whether Google acted on them, and Lumen's public pages show no takedown status. This is a dated dataset, so many of the databases may already have been disabled, and a hostname alone does not show what data a project held. Defenders should use the list for blocklisting, log searches and retrospective hunting, for example to find devices that contacted these hosts.

Financial and scheme impersonation (14)

a-comp-hdfc-apcd006-default-rtdb.firebaseio.com icici-kolkata-apcd001-default-rtdb.firebaseio.com id-selling-f67fe-default-rtdb.firebaseio.com ippb-ka-system-default-rtdb.firebaseio.com john-carder-default-rtdb.firebaseio.com new-rto-dev04-default-rtdb.firebaseio.com pm-kisan-11hcg-default-rtdb.firebaseio.com pm-kisan-12hfg-default-rtdb.firebaseio.com pm-kisan-25fyg-default-rtdb.firebaseio.com pm-kisan2-20361-default-rtdb.firebaseio.com pm-kishan-24bugf-default-rtdb.firebaseio.com pm348-4dca3-default-rtdb.firebaseio.com pmkisan2-c1211-default-rtdb.firebaseio.com pmkishan16-b178b-default-rtdb.firebaseio.com

Admin consoles and panels (20)

admin-c3805-default-rtdb.firebaseio.com lodakapanel1-default-rtdb.firebaseio.com londa-panel-bc1e2-default-rtdb.firebaseio.com mera-penal-default-rtdb.firebaseio.com monika-admin-panal-default-rtdb.firebaseio.com motte-admin-default-rtdb.firebaseio.com my-admin-06-default-rtdb.firebaseio.com my-admin-08-default-rtdb.firebaseio.com my-admin-10-default-rtdb.firebaseio.com my-admin-50-default-rtdb.firebaseio.com newadmin-d5116-default-rtdb.firebaseio.com panel-11th-default-rtdb.firebaseio.com panel-2-a3006-default-rtdb.firebaseio.com panel-4aa3d-default-rtdb.firebaseio.com panel-60588-default-rtdb.firebaseio.com puja-admin-panel-30a82-default-rtdb.firebaseio.com punj-admin-panel-default-rtdb.firebaseio.com purple-panel-56a96-default-rtdb.firebaseio.com renal-penal-default-rtdb.firebaseio.com yamraj-panel-setup-default-rtdb.firebaseio.com

Other flagged hosts (115)

amitabh-385d6-default-rtdb.firebaseio.com andandu-ee8f3-default-rtdb.firebaseio.com anko-e5c67-default-rtdb.firebaseio.com anuj2-3ffd8-default-rtdb.firebaseio.com anvith-af245-default-rtdb.firebaseio.com badka-3181b-default-rtdb.firebaseio.com bharwa-5fa4b-default-rtdb.firebaseio.com bihari-653c9-default-rtdb.firebaseio.com deppes-e3f05-default-rtdb.firebaseio.com dhoni26-default-rtdb.firebaseio.com fir-ffe67-default-rtdb.firebaseio.com hasan-63e57-default-rtdb.firebaseio.com hdeh-42e68-default-rtdb.firebaseio.com hdhdusgsvshshshs-default-rtdb.firebaseio.com hehe-679dd-default-rtdb.firebaseio.com hello-panda-903f3-default-rtdb.firebaseio.com help-r-default-rtdb.firebaseio.com hmfvk-72a3b-default-rtdb.firebaseio.com hospital-12no-8augu-default-rtdb.firebaseio.com hulkjjhh-default-rtdb.firebaseio.com humtsolo-default-rtdb.firebaseio.com hydra-sex-default-rtdb.firebaseio.com iiilsoee-default-rtdb.firebaseio.com illuminati-53c8e-default-rtdb.firebaseio.com imalin-19363-default-rtdb.firebaseio.com indejeet-d30fb-default-rtdb.firebaseio.com iopbb-ef4e8-default-rtdb.firebaseio.com iqbindus-88427-default-rtdb.firebaseio.com jackme-d67d7-default-rtdb.firebaseio.com jadugar-e2f73-default-rtdb.firebaseio.com jajaja-b9999-default-rtdb.firebaseio.com jddgdj44-default-rtdb.firebaseio.com jemini-9b00f-default-rtdb.firebaseio.com jshdh-7a573-default-rtdb.firebaseio.com jujkebur-default-rtdb.firebaseio.com juss-pilado-default-rtdb.firebaseio.com justalone3615154-default-rtdb.firebaseio.com kaizerxd786-bd7fa-default-rtdb.firebaseio.com kaju-adbc6-default-rtdb.firebaseio.com kamlusinghaniya-f05d5-default-rtdb.firebaseio.com kelaiiis-default-rtdb.firebaseio.com kindan-5a081-default-rtdb.firebaseio.com kingcobra01-default-rtdb.firebaseio.com kumar4545-645da-default-rtdb.firebaseio.com kumarboy-a1c72-default-rtdb.firebaseio.com kumarraj-6886e-default-rtdb.firebaseio.com kya-cheda-default-rtdb.firebaseio.com lak-70082-default-rtdb.firebaseio.com landu-540e4-default-rtdb.firebaseio.com liyon-3a81c-default-rtdb.firebaseio.com lodaajjurandj-default-rtdb.firebaseio.com lol27-4cd56-default-rtdb.firebaseio.com m90910540-a4e00-default-rtdb.firebaseio.com manish-ea556-default-rtdb.firebaseio.com master80221-753fb-default-rtdb.firebaseio.com master89812-b77a6-default-rtdb.firebaseio.com max018-2565f-default-rtdb.firebaseio.com maxjoker98-51d2b-default-rtdb.firebaseio.com meri-sona-default-rtdb.firebaseio.com milit-2f001-default-rtdb.firebaseio.com mkdd02-default-rtdb.firebaseio.com mnbvcxz-25a3e-default-rtdb.firebaseio.com monikamandalofficial-d64a4-default-rtdb.firebaseio.com monster-ad8ac-default-rtdb.firebaseio.com motb-10aae-default-rtdb.firebaseio.com ms-dhoni-26060-default-rtdb.firebaseio.com mukeshbhaids-default-rtdb.firebaseio.com munna-jija-ji-default-rtdb.firebaseio.com my-new-project-6067e-default-rtdb.firebaseio.com mylovejaan-e3b5d-default-rtdb.firebaseio.com neeraj-2eef2-default-rtdb.firebaseio.com njsnshdjssbb-default-rtdb.firebaseio.com noidaa-dda60-default-rtdb.firebaseio.com not-work-4d5c8-default-rtdb.firebaseio.com nunu-14cf2-default-rtdb.firebaseio.com nyawala-3e7c3-default-rtdb.asia-southeast1.firebasedatabase.app oct-341a3-default-rtdb.firebaseio.com odabu-91972-default-rtdb.firebaseio.com ok-yjsjysyjz-default-rtdb.firebaseio.com online-1e094-default-rtdb.firebaseio.com online-a2823-default-rtdb.firebaseio.com online-friends-c9b41-default-rtdb.firebaseio.com paaaan-2c826-default-rtdb.firebaseio.com pagal-8c47e-default-rtdb.firebaseio.com pan3-3413e-default-rtdb.firebaseio.com pankaj-fa701-default-rtdb.firebaseio.com pankaj-sir-f9973-default-rtdb.firebaseio.com phubgshzzz-default-rtdb.firebaseio.com pin-nhi-aaya-default-rtdb.firebaseio.com pinta-c3912-default-rtdb.firebaseio.com pintukk-84675-default-rtdb.firebaseio.com piyushg-9d7f1-default-rtdb.firebaseio.com pkms-1db86-default-rtdb.firebaseio.com planning-with-ai48-default-rtdb.firebaseio.com prince-8ba30-default-rtdb.firebaseio.com prince-cf8ae-default-rtdb.firebaseio.com private-527ce-default-rtdb.firebaseio.com private-company-exploit-default-rtdb.firebaseio.com priyanshu-4d425-default-rtdb.firebaseio.com priyanshuu-default-rtdb.firebaseio.com project-k-426be-default-rtdb.firebaseio.com pujakumari2211-ac3ab-default-rtdb.firebaseio.com raajraaj-75b44-default-rtdb.firebaseio.com rahul-c06bf-default-rtdb.firebaseio.com raju-2d429-default-rtdb.firebaseio.com riya-f7132-default-rtdb.firebaseio.com rubbaajii-default-rtdb.firebaseio.com sabhojayega-e0558-default-rtdb.firebaseio.com sexyvideo-42aa2-default-rtdb.firebaseio.com sharuji-f8a09-default-rtdb.firebaseio.com stephen-40caf-default-rtdb.firebaseio.com sumit-1c42f-default-rtdb.firebaseio.com uggu-6e43c-default-rtdb.firebaseio.com vzvxvz-default-rtdb.firebaseio.com womkomdu-default-rtdb.firebaseio.com

What Users Can Do

Do not install APK files sent over SMS, WhatsApp or social media, even if they claim to come from a bank, PM-KISAN or the RTO. Never give an unknown app SMS or Accessibility access. Anyone who has been defrauded should call the national cybercrime helpline 1930 or file a complaint at cybercrime.gov.in as soon as possible.

Sources

• Lumen Database, notice 100795192, I4C to Google LLC, sent Oct. 22, 2026 (112 hosts): lumendatabase.org/notices/100795192
• Lumen Database, notice 101418971, I4C - MHA to Google LLC, sent Oct. 23, 2026 (31 hosts): lumendatabase.org/notices/101418971
• Lumen Database, notice 101418978, I4C - MHA to Google LLC, sent Oct. 26, 2026 (15 hosts): lumendatabase.org/notices/101418978
• Google Legal Help, About Lumen: support.google.com
• Ministry of Cyber Affairs, India Orders Google to Pull 174 Firebase Databases Powering Android Banking Malware (Oct. 17, 2026): ministryofcyberaffairs.com
• Ministry of Cyber Affairs, India orders blocking of 216 Google Firebase databases in single day (Sept. 25, 2026): ministryofcyberaffairs.com
• Media report: Reuters, India orders removal of Google Firebase accounts after spotting scam pattern (Aug. 21, 2026): reuters.com
• National Cyber Crime Reporting Portal: cybercrime.gov.in