India Orders Google to Pull 174 Firebase Databases Powering Android Banking Malware | IOCs
India's I4C has sent Google five new takedown orders, dated 1 and 9 October 2026, covering 174 Firebase databases and phishing sites used in "Android God Mode" banking malware that steals OTPs, SMS and card data. The orders follow 57 takedowns in August and 216 on 20 September, bringing disclosed Firebase takedowns since August to more than 440.
India's Indian Cyber Crime Coordination Centre (I4C), under the Ministry of Home Affairs, has fired off a fresh wave of takedown orders to Google, targeting 174 Firebase databases and phishing sites that criminal gangs used as the engine of an Android banking-malware operation.
The orders, contained in five Government Request notices that Google submitted to the Lumen Database, were sent on 1 October and 9 October 2026. They follow 57 Firebase assets flagged in August and 216 Realtime Databases ordered down in a single day on 20 September. That brings disclosed Firebase takedowns since August to more than 440.
The notices were reportedly sent through the Sahyog Portal, the I4C platform that automates notices under Section 79(3)(b) of the Information Technology Act, 2000. Intermediaries such as Google must disable access quickly, within three hours according to officials, or risk losing their safe-harbour protection. There is no suggestion in the notices that Google itself is at fault. The targets are criminal projects hosted on its free tier.
The five notices break down as follows:
- 98254362 (1 October): 49 entries
- 98817556 (1 October): 54 entries
- 99387758 (9 October): 3 entries
- 99387763 (9 October): 29 entries
- 99387766 (9 October): 42 entries
Together they list 177 entries. Three databases appear in two notices each, leaving 174 unique targets: 171 Firebase Realtime Databases (`*-default-rtdb.firebaseio.com`) and three Firebase Hosting phishing sites (`.web.app`) posing as Axis Bank, ICICI Bank and RBL Bank card services.
Why Criminals prefer Firebase
- It runs on a trusted Google domain that rarely trips SMS or email filters.
- The free Spark plan needs no card or KYC, so projects can be created anonymously.
- A Realtime Database works as both command server and data drop: the malware pushes stolen SMS and OTPs, and the attacker's panel sees them almost instantly.
- There is no VPS or IP address to seize, only cloud infrastructure.
The "Android God Mode" Attack Chain
1. Lure: SMS messages or social media ads offer PM-KISAN payouts, RTO challan discounts, credit-card limit upgrades or reward redemptions.
2. Sideload: The victim installs a malicious APK from outside the Play Store.
3. Takeover: The app demands Accessibility, SMS and Notification permissions, giving near-total control of the phone. Officials call this "Android God Mode".
4. Exfiltration: Stolen SMS, OTPs and card details stream to the Firebase database in real time.
5. Cash-out: Operators drain UPI and net-banking accounts before the OTP expires.
Investigating the names of Firebase
The database names expose the underground economy behind them:
- Panel operators: `admin-panel-`, `chutar-panel`, `kd-panel`, `ahmedpanel` and `hacking-guru`
- Bank-specific kits: a "kha-" series naming an operator, a target bank and a date, such as `kha-ramesh-axiscc-0034-6-10-26`, `kha-abid-rbl-ind-2239-2-10-26` and `kha-aditya-yescc-1606-5-10-26`. The dates embedded in these names run from 12 September to 6 October, just days to weeks before the 9 October notice, which suggests fresh databases are spun up for each batch of victims and taken down almost as fast.
- Government-service clones: `rto-challan` and `pm-kishan`
- Lookalikes and obscene labels: `customesbif1` and crude adult names that circulate with Telegram malware kits
Global Implications
The victims are mostly Indian, but the infrastructure is global. The same free Firebase tier that serves legitimate developers worldwide is being used as disposable criminal infrastructure, and operators move quickly to it whenever conventional hosting is disrupted. Security researchers have also documented Firebase-backed Android malware families such as GhostBat RAT targeting Indian UPI users with fake PIN overlays.
Indicators of Compromise (IOCs)
The 174 unique domains below are taken from the five Lumen notices sent by I4C-MHA to Google LLC. Defenders, researchers and platform teams should treat them as high-confidence malicious infrastructure. Many are likely to have been disabled already.
# | Domain |
|---|---|
1 | abhishek-e9c70-default-rtdb.firebaseio.com |
2 | admin-29dd0-default-rtdb.firebaseio.com |
3 | admin-new-pann-default-rtdb.firebaseio.com |
4 | admin-panel-b2935-default-rtdb.firebaseio.com |
5 | admin-sexxy-default-rtdb.firebaseio.com |
6 | admon-aeba0-default-rtdb.firebaseio.com |
7 | adsinprogess-default-rtdb.firebaseio.com |
8 | adultapk-c3c4f-default-rtdb.firebaseio.com |
9 | ahmedpanel-e3d2d-default-rtdb.firebaseio.com |
10 | ajit-20ba4-default-rtdb.firebaseio.com |
11 | ak-kumar-af997-default-rtdb.firebaseio.com |
12 | alina28-a35a7-default-rtdb.firebaseio.com |
13 | allinone-cf029-default-rtdb.firebaseio.com |
14 | alok-aded3-default-rtdb.firebaseio.com |
15 | amanbhai-4431c-default-rtdb.firebaseio.com |
16 | amitda-536a6-default-rtdb.firebaseio.com |
17 | anup-9a7a2-default-rtdb.firebaseio.com |
18 | apkdriod-f6fb9-default-rtdb.firebaseio.com |
19 | apun-e55af-default-rtdb.firebaseio.com |
20 | arda-2fc05-default-rtdb.firebaseio.com |
21 | arunhah-902ef-default-rtdb.firebaseio.com |
22 | ashish-amit-k-default-rtdb.firebaseio.com |
23 | atifking65-d9837-default-rtdb.firebaseio.com |
24 | axiscardse.web.app |
25 | aya-tandi-default-rtdb.firebaseio.com |
26 | babitajiappcom-default-rtdb.firebaseio.com |
27 | babuji-efd18-default-rtdb.firebaseio.com |
28 | bb-with-uuu-11-cf-default-rtdb.firebaseio.com |
29 | bhai-e9dd0-default-rtdb.firebaseio.com |
30 | bhai-ji-466cc-default-rtdb.firebaseio.com |
31 | bhai3-29210-default-rtdb.firebaseio.com |
32 | bhaiyaka-bcbcd-default-rtdb.firebaseio.com |
33 | bharatnxt-ef4f5-default-rtdb.firebaseio.com |
34 | bhogta-34897-default-rtdb.firebaseio.com |
35 | bikadh-e7e9f-default-rtdb.firebaseio.com |
36 | bikram-c8fca-default-rtdb.firebaseio.com |
37 | bipin-bad-default-rtdb.firebaseio.com |
38 | chachaji-4db07-default-rtdb.firebaseio.com |
39 | charku-56ff4-default-rtdb.firebaseio.com |
40 | chhotahekar-default-rtdb.firebaseio.com |
41 | chunnukraj-fcc55-default-rtdb.firebaseio.com |
42 | chutar-panel-default-rtdb.firebaseio.com |
43 | chutkao-fed0e-default-rtdb.firebaseio.com |
44 | customesbif1-default-rtdb.firebaseio.com |
45 | dabu-a08f4-default-rtdb.firebaseio.com |
46 | deo-admin-penal-2-default-rtdb.firebaseio.com |
47 | dhiraj-3492c-default-rtdb.firebaseio.com |
48 | dipak-659b8-default-rtdb.firebaseio.com |
49 | dseronmeok-default-rtdb.firebaseio.com |
50 | e0turnament1-default-rtdb.firebaseio.com |
51 | e31turnament1-default-rtdb.firebaseio.com |
52 | eaglefudkaega-default-rtdb.firebaseio.com |
53 | ffdfhf-aa168-default-rtdb.firebaseio.com |
54 | fir-15bee-default-rtdb.firebaseio.com |
55 | fir-56c8f-default-rtdb.firebaseio.com |
56 | fir-d9f5b-default-rtdb.firebaseio.com |
57 | fufa-b7fa2-default-rtdb.firebaseio.com |
58 | gautam-febce-default-rtdb.firebaseio.com |
59 | gddfgg-fsff-ff-default-rtdb.firebaseio.com |
60 | gigga1-default-rtdb.firebaseio.com |
61 | golu-bc00a-default-rtdb.firebaseio.com |
62 | hacking-guru-e3be5-default-rtdb.firebaseio.com |
63 | harami-fe6e1-default-rtdb.firebaseio.com |
64 | hospitel-5-default-rtdb.firebaseio.com |
65 | hshshhs-51f68-default-rtdb.firebaseio.com |
66 | hsm2pro21-default-rtdb.firebaseio.com |
67 | hush-e1f72-default-rtdb.firebaseio.com |
68 | huuuu-28599-default-rtdb.firebaseio.com |
69 | icicicardhelps.web.app |
70 | ilohsh-default-rtdb.firebaseio.com |
71 | jp-hub-5c701-default-rtdb.firebaseio.com |
72 | junaid-9b63a-default-rtdb.firebaseio.com |
73 | kajalkumari-4d7a5-default-rtdb.firebaseio.com |
74 | kd-panel-default-rtdb.firebaseio.com |
75 | kha-abid-rbl-ind-2239-2-10-26-default-rtdb.firebaseio.com |
76 | kha-aditya-yescc-1606-5-10-26-default-rtdb.firebaseio.com |
77 | kha-laxman-axiccc-1528-4-10-26-default-rtdb.firebaseio.com |
78 | kha-laxman-axis1013-2-10-26-default-rtdb.firebaseio.com |
79 | kha-raja-axis-0910-3-10-26-default-rtdb.firebaseio.com |
80 | kha-ramesh-axiscc-0034-6-10-26-default-rtdb.firebaseio.com |
81 | kha-sid-rbl-idfc-1002-290926-default-rtdb.firebaseio.com |
82 | khalid-mahad-axiscc-0857-6888f-default-rtdb.firebaseio.com |
83 | khalid-raja-2112-axisd3-120926-default-rtdb.firebaseio.com |
84 | kiran-6146d-default-rtdb.firebaseio.com |
85 | kishorkumar-ec558-default-rtdb.firebaseio.com |
86 | knsnsn-8a8eb-default-rtdb.firebaseio.com |
87 | koya-7acd9-default-rtdb.firebaseio.com |
88 | kumar-8f205-default-rtdb.firebaseio.com |
89 | kunal-rbl-2335-1-10-26-default-rtdb.firebaseio.com |
90 | kundan-c848c-default-rtdb.firebaseio.com |
91 | land-e0aa1-default-rtdb.firebaseio.com |
92 | landkadev-2c7cd-default-rtdb.firebaseio.com |
93 | laxminarayan-ccca5-default-rtdb.firebaseio.com |
94 | ljgyhhgff-default-rtdb.firebaseio.com |
95 | lodabhat-bfd8f-default-rtdb.firebaseio.com |
96 | loki-penal-default-rtdb.firebaseio.com |
97 | love-adcf6-default-rtdb.firebaseio.com |
98 | manali-e1796-default-rtdb.firebaseio.com |
99 | matrixpannel40-default-rtdb.firebaseio.com |
100 | maxjoker98-2cdfe-default-rtdb.firebaseio.com |
101 | mi-admin-7c5f0-default-rtdb.firebaseio.com |
102 | mohamed829-e37d3-default-rtdb.firebaseio.com |
103 | mopsgsh-default-rtdb.firebaseio.com |
104 | mr-don-44c75-default-rtdb.firebaseio.com |
105 | munna-56e05-default-rtdb.firebaseio.com |
106 | myname-cc45a-default-rtdb.firebaseio.com |
107 | naina-singh-default-rtdb.firebaseio.com |
108 | nandanbr-357eb-default-rtdb.firebaseio.com |
109 | net-c-f0054-default-rtdb.firebaseio.com |
110 | newbhai-99806-default-rtdb.firebaseio.com |
111 | newtan3450-default-rtdb.firebaseio.com |
112 | okok-77c0d-default-rtdb.firebaseio.com |
113 | pakodhi-penal-default-rtdb.firebaseio.com |
114 | panel-chut07-default-rtdb.firebaseio.com |
115 | papikajaadu-default-rtdb.firebaseio.com |
116 | pm-kishan-b4-default-rtdb.firebaseio.com |
117 | pm280reolc-default-rtdb.firebaseio.com |
118 | pmnew157-default-rtdb.firebaseio.com |
119 | pn-ser-default-rtdb.firebaseio.com |
120 | pnb-one-a13-default-rtdb.firebaseio.com |
121 | pom-pom-dhar-default-rtdb.firebaseio.com |
122 | pussy-25f3c-default-rtdb.firebaseio.com |
123 | rahul-boss-bob-1343-2-10-26-default-rtdb.firebaseio.com |
124 | rajivbihar-e2161-default-rtdb.firebaseio.com |
125 | raju-7f9f8-default-rtdb.firebaseio.com |
126 | ramess-default-rtdb.firebaseio.com |
127 | rathore-e0ef2-default-rtdb.firebaseio.com |
128 | ravan-187d8-default-rtdb.firebaseio.com |
129 | ravindra-d7887-default-rtdb.firebaseio.com |
130 | rblcards.web.app |
131 | rcbfan-1c031-default-rtdb.firebaseio.com |
132 | rockey-8b546-default-rtdb.firebaseio.com |
133 | rohit-9cb8b-default-rtdb.firebaseio.com |
134 | rohitg-67b50-default-rtdb.firebaseio.com |
135 | room-hotel-default-rtdb.firebaseio.com |
136 | root2-cc8bc-default-rtdb.firebaseio.com |
137 | rosni-9bb5c-default-rtdb.firebaseio.com |
138 | rto-10-default-rtdb.firebaseio.com |
139 | rto-34-1f836-default-rtdb.firebaseio.com |
140 | rto-challan-76f0e-default-rtdb.firebaseio.com |
141 | rto23-a5d99-default-rtdb.firebaseio.com |
142 | rudrarendi2-default-rtdb.firebaseio.com |
143 | sachin-38c1d-default-rtdb.firebaseio.com |
144 | sadboy-417a7-default-rtdb.firebaseio.com |
145 | sakshi9-92691-default-rtdb.firebaseio.com |
146 | sanjee-39ed8-default-rtdb.firebaseio.com |
147 | santosh-c4095-default-rtdb.firebaseio.com |
148 | sarita-setup-default-rtdb.firebaseio.com |
149 | scamwala-banda-default-rtdb.firebaseio.com |
150 | selfusingbak-default-rtdb.firebaseio.com |
151 | sell3-1-default-rtdb.firebaseio.com |
152 | shubh-befd9-default-rtdb.firebaseio.com |
153 | skfd-53f1f-default-rtdb.firebaseio.com |
154 | slim-pussy-default-rtdb.firebaseio.com |
155 | sohan-6d9e1-default-rtdb.firebaseio.com |
156 | sonam-872e5-default-rtdb.firebaseio.com |
157 | sonikr-db0f3-default-rtdb.firebaseio.com |
158 | sumnmmn-default-rtdb.firebaseio.com |
159 | sunil-da-default-rtdb.firebaseio.com |
160 | super-admin-240f4-default-rtdb.firebaseio.com |
161 | surajbabu-17a9e-default-rtdb.firebaseio.com |
162 | surajptiyanka-default-rtdb.firebaseio.com |
163 | teddymcdonald-81002-default-rtdb.firebaseio.com |
164 | trex-58a74-default-rtdb.firebaseio.com |
165 | uday-gaw-default-rtdb.firebaseio.com |
166 | ujiji-75f8b-default-rtdb.firebaseio.com |
167 | ukhhkggy-default-rtdb.firebaseio.com |
168 | urqhjdjdj-default-rtdb.firebaseio.com |
169 | uuuu-c9515-default-rtdb.firebaseio.com |
170 | vijafhh-4bb40-default-rtdb.firebaseio.com |
171 | wtx-era-default-rtdb.firebaseio.com |
172 | xxxx-e322a-default-rtdb.firebaseio.com |
173 | yt-bhai-fd324-default-rtdb.firebaseio.com |
174 | z-amit-apr-29-default-rtdb.firebaseio.com |
Source: Lumen Database Government Request notices 98254362, 98817556, 99387758, 99387763 and 99387766, sent by I4C-MHA to Google LLC on 1 and 9 October 2026.