Researcher flags xn--goog-yva5t.com Google lookalike tracking searches
Researcher @Malwarehunterr says Google lookalike xn--goog-yva5t.com logs searches, clicks and highlighted text and sells dashboard access. Google is not involved.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 6 November 2026 the security researcher @Malwarehunterr posted on X about a Google-lookalike domain, xn--goog-yva5t[.]com, that works as a functional search engine while collecting what visitors do. The xn-- prefix shows it is a punycode domain, which can display in a browser using look-alike characters so that the name resembles Google. The site is not a Google domain and Google is not involved.
How the scam works
According to the post, the site records search queries and the links visitors click, proxies external websites and injects JavaScript into them to capture text that visitors highlight, and strips Content Security Policy protections from proxied pages. The collected activity is sent to a Firebase Firestore project named search1y, in collections called searchEvents, clickEvents and highlights.
The researcher says the site also includes Stripe-based paid access to a live dashboard at /Messages.html, and that its Firebase rules explicitly allow paying users to view other visitors' searches, clicked URLs and highlighted text, organised into individual activity feeds. In other words, what one person types into the lookalike search box may be offered for sale to someone else. The post lists a sign-in page at /Signin.html, API endpoints such as /api/search and /api/a?url=, several JavaScript files and an additional reference, searchly-five.vercel[.]app.
The researcher is careful to say the source code confirms the monitoring design and paid-access permissions, but that actual paid subscriptions and live data access were not independently verified, and that no password theft or malware delivery was identified. The risk is privacy exposure: searches often contain names, health questions, addresses and account details. Use google.com or the official Google app, check the address bar for odd characters, and never sign in to a Google account on a lookalike site. The details come from the researcher's post and have not been independently checked by scammers.com.
Source
Post by @Malwarehunterr on X, 6 November 2026, on xn--goog-yva5t[.]com. Not independently verified by scammers.com.
Red flags
- A search page that looks like Google but has an xn-- punycode address.
- Unusual characters in what looks like the word Google in the address bar.
- A search site that asks you to sign in or pay for a dashboard.
- Search results that open other websites inside the same lookalike page.
If you were targeted
- 1Type google.com yourself or use the official Google app for searches.
- 2Check the full address bar before searching or signing in; avoid punycode lookalikes.
- 3Never enter Google account credentials on a site you reached from a link or ad.
- 4Assume anything searched on the lookalike site may have been recorded; avoid entering personal details there.
- 5Report the domain to Google Safe Browsing.