#dev 2026-03-25

2026-03-25 UTC
cotsuka, [Michael_Kupiet], Virtual, Bleh, troojg, oodani, thegreekgeek_, [tantek]2, nsh, grufwub, thegreekgeek, barnaby, BlingBling, redshuffle, kishy, WinnerWind, lars_the_bear, lars_the_bear_, jjuran, blacklight, Kolev, [marksuth], NegateThis, kishy-lib, [Jo], ax562, deathcomestotime and [aciccarello] joined the channel
#
[artlung] I have a spam/dev email I want to understand.
#
[artlung] `Follow this link to reset your %REDACTED% password for your mailto:joe@artlung.com account.`
#
[artlung] `https:// %REDACTED% http://firebaseapp.com/__/auth/action?mode=resetPassword&oobCode=okYLj8xjyR_fyxVgym-ZUGIV5h6mBSWHN_90XzL-e2YAAAYdItGCXA&apiKey=AIzaSyBwNjvHluwuKNLMAdXE9S4FIc1pKVqodXQ&lang=en&tenantId=unno1-t-051-no52t`
#
[artlung] `Your %REDACTED% team`
#
[artlung] `If you didn't ask to reset your password, you can ignore this email.`
#
[artlung] `Thanks,`
#
[artlung] %REDACTED% is a short name but not a brand I recognize or anything that comes up when I search. My question is - is this just an attempt at spam? Or is this someone's dev experiment that went awry? Or could this be phishing somehow but the name on the firebase instance is munged or normally hidden?>
#
[artlung] I'm not clicking it, just trying to guess the route by which it happened. I've used firebase a few times to temp create ad hoc key value stores for users in prototypes. But seems like normally firebase is hidden plumbing.
[schmarty] joined the channel
#
[schmarty] this looks like a phishing email, yeah.
#
[artlung] could it be for a service that I use, but the firebase redacted subdomain I would not recognize?
#
[schmarty] i get sort-of similar emails for domains that are basically guessing whether i have a particular service set up for that domain. like "oh no your google apps for workplace emails! better log in!"
#
[schmarty] my guess is they are just using firebase as a convenient place to host their credential phishing, but they put in the effort to name the firebase app consistently with whatever service they are trying to trick you into thinking you need to login to.
#
[artlung] that's the thing. the string is just... nothing I recognize. Not a project out in the world
#
[morgan] LLM generated spam that doesnt even work at phishing?
#
[artlung] excuse me counselor, assuming facts not in evidence.
#
[morgan] Hmmm, yes. Its weird. Just the thought passed my mind that maybe its defective
#
[morgan] If Im reading right, there was no firebase app at that url and you had a look at it?
#
[artlung] the domain *did* exist yesterday. it *does not* exist today. "Site not found" ... so that's more evidence for phishing.
#
[morgan] Oh got it, yeah that definitely seems like something malicious
#
[artlung] other interpretation is a one off experiment from a developer. my email is 30 years old.
#
[artlung] but this is one of those "no evidence solidly diagnosing the source is likely" - email headers inconclusive
#
[artlung] [schmarty]++ thanks for lending me your thoughts [morgan]++
#
Loqi [morgan] has 4 karma in this channel over the last year (17 in all channels)
#
Loqi [schmarty] has 9 karma in this channel over the last year (36 in all channels)
#
[schmarty] artlung++ for spotting a scam 😄
#
Loqi artlung has 43 karma in this channel over the last year (253 in all channels)
#
[artlung] it *almost* merits a scam tag post https://artlung.com/blog/tag/scam/
#
[morgan] I was recommended this podcast that I intend to listen to, about the recent trends in scams https://podcasts.apple.com/us/podcast/667-heres-why-you-are-constantly-fighting-off-scammers/id354668519?i=1000754955145
blacklight, geoffo, cotsuka, ax562, gRegor, barnaby, vriska, WinnerWi-, deathcomestotime, dustinm`, [Sophia_wood], troojg and [snarfed] joined the channel