Security Scan Report: www.xn--gool-yva2d.com

Redirected to:
https://xn--gool-yva2d.com/
Submitted: Completed: publiccompleted
This website contacted 13 IPs in 4 countries across 8 domains to perform 30 HTTP transactions. The main domain is xn--gool-yva2d.com and was registered 4 months ago.

Submitted URL: https://www.xn--gool-yva2d.com

Effective URL:
https://xn--gool-yva2d.com/
Redirected

AI Security Verdict

High Risk

Confidence: 82%

8
Risk Score

Punycode homograph of 'google' serving Google-branded content and forwarding visitor emails to the unranked host shahulbreaker.in. Classic brand-impersonation capture page — do not submit data.

Risk Factors (5)
homograph/typosquat domain imitating Google
Google-branded content on a non-Google domain
user-supplied email exfiltrated to an unranked external endpoint (shahulbreaker.in, endpoint named getdata.php?user=googly)
hidden metadata form fields consistent with a capture kit
domain unranked in Cisco Umbrella and only ~120 days old
Domain age information unavailable

Details

Page Title

xn--gool-yva2d.com

Scan Type

public

Domain Name Analysis

You're looking at domain 'www.xn--gool-yva2d.com' on the commercial generic top-level domain (.com), featuring subdomain 'www'. The registrable portion 'xn--gool-yva2d' spans 14 characters split between three vowels and seven consonants; bonus characters include 1 digit and 3 hyphens. It segments into six words: xn, gool, y, va, 2, d. Average segment length settles at 1.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

ALL IMAGES f{) 333 Google Q GC & @& Google offered in: fect aeet Sent Met sp rAd se 08IMI80 uUnTat

Page Load Overview

0.60s
Total Load Time
3.1 MB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en-US
Text Length:463 chars
Detector Agreement:100%

Website Classification

Primary Category

social media network49% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

social media network
49%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
692.113.16.243Frankfurt am Main, Hesse, Germany
AS47583Hostinger International Limited
2192.178.183.95Google · CDNUnited States
AS15169Google LLC
2142.251.13.94Google · CDNUnited States
AS15169Google LLC
292.113.16.37Frankfurt am Main, Hesse, Germany
AS47583Hostinger International Limited
2142.251.110.95Google · CDNUnited States
AS15169Google LLC
2142.251.14.94Google · CDNUnited States
AS15169Google LLC
292.113.16.135Frankfurt am Main, Hesse, Germany
AS47583Hostinger International Limited
292.113.16.6Frankfurt am Main, Hesse, Germany
AS47583Hostinger International Limited
292.113.16.194Frankfurt am Main, Hesse, Germany
AS47583Hostinger International Limited
2104.16.56.10Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
3013--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T1AFE3D625722C80217E5B8B2BA1CFA70CA134B585D5244695FC3E22841FC9DFA76B3F6D

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

3072:FhVeiZobwemlUVugammZobFemlUVugamKMLf1FjhGJWa4+ZBSYXjxNA00JGk5I:YiZobwemlUVugammZobFemlUVugamtaX

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:146559:DTDCKCmQIx2jLIBGADnUIhSCsrBsAIoMBBGADxCQVEHAEgYFSTkckQFAQYQWPAKHCOdwAbyWAprghHVyYQQ4RB0AjQhiCE0p

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:c1fbe7e7fbffc7e7
Perceptual Hash:e96969496d636389
Difference Hash:12120c0d220a0e0e
Wavelet Hash:81dbe7e78181c3c3
Color Hash:07001000180

Other Hashes

Crop Resistant:12120c0d220a0e0e

Scan History

Scan history not available

Unable to load historical scan data