Here's a Secret : Google.com is not google.com

ɢoogle.com isn’t google.com

Google Analytics has become a great target for spammers, where they leave fake traffic that draws unwary website owners to investigate where it came from. This week one of those spammers left a ‘Vote for Trump‘ message in many people’s analytics reports. What most people didn’t notice was that the website it referenced looked like secret.Google.com, which it wasn’t.

In fact, the letter ‘G’ is a Latin Letter Small Capital, Unicode 0262. Compared side by side with a real capital G, they would look like ‘ɢ G’ — see the difference? Notice how the ‘G’ in the image is the same size as the lowercase letter ‘o’? It’s not the G you thought it was.

If you click that link, it takes you to ɢoogle.com, not google.com! You have just clicked into the spammer’s website, where anything could happen.

Well, someone, somewhere, gave out the domain ɢoogle.com to someone who was not representing google.com. What is stopping them from mimicking YOUR website, and then leaving innocent-looking links for you to fall prey to? You would probably never realise what you did until it was tool late.

Internationalized Domain Names :

Most people don’t realise it, but there were a lot of people working the past few years on getting international characters into domain names and they are real today. They are supposed to allow people to create domains in their native language, like 日本語.jp. Seems at least one enterprising individual (in Russia) grabbed the opportunity recently to snap up ɢoogle.com.

Expect to see a sharp increase in phishing until the general public catches on.

Instructions below show how to build a Filter to block this particular attack. To get historical spam out of your reports, use the Segment I posted to the Google Analytics Solution Gallery. Remember to change the Segment to use your website domain name in the first expression!