The download at the top of Google wasn't the real one

A lot of the scams I write about here have to come and find you first. A text about a parcel. An email about your bank. A QR code stuck on a parking meter. This one doesn't need to bother. You go looking for the thing yourself, you type its name into Google, and the fake is sitting above the real one in the results. Nobody had to send you anything. 😅

What happened in August?

On 24 August 2026, The Hacker News reported a malware campaign called Weedhack, spreading through fake Minecraft client websites. The malware itself isn't the interesting part. The delivery is.

Spoofed websites for two popular clients, Xenon Client and Nova Client, showed up at the top of search results across Google, Microsoft Bing, Brave Search and DuckDuckGo. Not in the ad slot. In the normal, organic results — the ones we're all taught to trust more than ads. McAfee Labs blocked over 6,300 attempts to reach those sites.

This trick has a name: SEO poisoning. Someone builds a convincing copy of a project's website and optimizes it hard enough to outrank the real thing. It works best on software that isn't in an app store — mods, game clients, small utilities, "cracked" tools. There's no official listing to compare against, so the search result becomes the authority.

So what did the fake domains look like?

Nothing exotic. Two of them added one hyphen.

A hyphen is a nasty choice, because it doesn't look wrong. Plenty of real companies hyphenate their names. If you've never seen the real domain written out, there's simply nothing in glazed-client[.]com to catch your eye — and your memory of a name you read once, months ago, isn't that precise. Mine certainly isn't. 🤓

Others changed the ending instead: a .lol address standing in for a .com. One was built on a free AI website builder, living on a subdomain of that builder rather than on any domain of its own.

Then it sends you somewhere else for the actual file

Here's the part I'd teach a teenager first. The fake website is often not where the file lives. In this campaign the malicious links broke down like this:

Nearly half were Discord attachments. That's the tell. A real project serves its releases from its own domain, or from a well-known code host under its own account. A polished, official-looking site that sends you off to a chat attachment has quietly split the trust (the website you looked at) from the payload (the file you actually run). You only ever inspected the first half.

The report notes the files were Java archives that could collect system information, add themselves to Microsoft Defender's exclusion list so the scanner would skip them, and steal sensitive data. A game mod has no reason to touch your antivirus settings. None.

Why does this one land on families?

Because Minecraft clients are a kid's search. So are texture packs, mod loaders and "free" versions of paid games. A twelve-year-old typing a client name into Google has no mental model of how domains are spelled, no memory of the project's real address, and every reason in the world to click the first result and run whatever it gives them. On the family laptop.

Two of the domains in this campaign were named after a "crack" of a paid client, which tells you exactly who was meant to find them. Unfortunately, searches for cracked or free software are the riskiest searches on the internet — the person doing them has already decided to step slightly off the official path, so a warning sign starts to look like part of the deal.

How do you check a download domain before you run anything?

1. Find the project's real address somewhere other than the search results. Its GitHub repository, its subreddit sidebar, its Discord server description, a wiki page. You want a second, independent source for that domain — not the same search page that just served you the fake one.
2. Compare the two domains character by character, hyphens and endings included. Copy them, don't retype them. Retyping quietly corrects the very difference you're hunting for.
3. Look at where the download actually goes. Right-click the download button and copy the link address before you click it. If it heads off to a chat attachment or a file locker, that's a question to answer, not a detail to skip.
4. Check how old the domain is. A client that's been around for years shouldn't be served from a domain registered five weeks ago.
5. Or paste the domain into IP Tracker and let it do the boring version of all of the above at once.

So what can IP Tracker actually do here?

IP Tracker is my free Chrome extension. Paste a domain or a full email address into the popup; the free tier gives you 25 checks a day, no account, no tracking. Only the value you paste is looked up.

Let me give you the bad news first, because it's real. IP Tracker will not tell you that glazed-client[.]com is pretending to be glazedclient.com. The lookalike comparison runs against a curated list of about 125 heavily impersonated brands — banks, payment services, couriers, big tech, government sites, crypto, streaming. Small gaming projects aren't on that list, and honestly they never will be. No brand entry, nothing to compare against, nothing to say.

However, the useful signal here was never the spelling. It's everything around the domain:

• How old the domain is. The creation date from WHOIS. A site claiming to be an established project, sitting on a domain a few weeks old, is a real contradiction. For this scam, it's the single most useful field on the screen.
• Google Safe Browsing. Whether Google's blocklist has flagged the address. Strong on known-bad sites, slow on brand-new ones.
• VirusTotal. How many security vendors currently flag the domain, counted from the detections rather than from vendor category labels.
• Where it's actually hosted. The Hosting card shows the addresses the domain resolves to and the platform behind them. If a site is sitting on a free website builder's own subdomain, it says so, and notes that this is unusual for a bank, a courier or a government site. For a hobby game project a free host is perfectly normal — so read that one as context, not as an accusation.
• Abuse reports on the resolved address. With one honest caveat: when a site hides behind a shared CDN, reports against that address belong to thousands of unrelated sites and have nothing to do with this one. IP Tracker says so instead of counting them against the site.

And one gap I should own

One of the fake sites in this campaign was built on a free AI website-builder subdomain. IP Tracker recognizes a long list of free builders and platforms, but not every single one, and that particular builder isn't in the list yet. If it doesn't recognize the platform, the Hosting card simply won't name it.

So don't read a quiet Hosting card as a clean bill of health. It might just be a platform the extension hasn't learned yet. I'd rather tell you that here than let you walk away thinking the coverage is complete. 😉

To summarize

• ✓ Top of the search results is a ranking, not a safety check.
• ✓ One added hyphen is enough, and it doesn't look wrong.
• ✓ Get the project's real domain from a second source, then compare character by character.
• ✓ If the official-looking site sends you to a chat attachment for the file, stop and ask why.
• ✓ Check the domain's age. An old project on a new domain is a contradiction worth resolving.

If there's a kid in your house who installs game mods, this is the conversation to have. Not "don't download things", because nobody follows that. Something more like: "check the address twice, and tell me if the file comes from somewhere strange."

Happy (careful) modding! 😎

Sources

• Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning, The Hacker News, 24 August 2026.