I have a staging deployment on staging.firebaseapp.com and I'm receiving a password reset email from firebase for an account that doesn't exist but the attacker is correctly guessing the domain name on which valid email/users are registered on. There is no indication anywhere towards that domain, so that's still a mystery in terms of how he is guessing it.
I log everything once someone is successfully logged in - however since the attempt involves a non-existent user/account but with an/the accurate domain such a user would be registered from (no clue what vector he is using to have accurately determined that) - the login fails and all I get is a password reset request. (again, for a nonexistent user account but registered on the correct domain if that user would have existed)
- Is there any way to determine and log the failed attempts IP address and other info, from the login page or something?