Then you would've seen some encrypted traffic to firebase which probably include...

		lyu07282 7 months ago \| parent \| context \| favorite \| on: Taking over 60k spyware user accounts with SQL inj... Then you would've seen some encrypted traffic to firebase which probably includes a bunch of legitimate apps on your phone too.