Googling Firebase got me a phishing page hosted by Google

Alphabet just had its worst day since going public in 2004 and lost about $475 billion in market value. I’m not that surprised. Today Google sold me a phishing page for its own product, so the market may have a point.

I needed to add a new app to Firebase for push notifications. I was too lazy to type the full address, so, like all boomers, I typed “Firebase” into the Chrome address bar and clicked the first result.

The site looked exactly like Firebase, including the banner about the release of Gemini 4 Argon, so I clicked Go to console without suspecting anything. The phishers clearly follow Google’s releases more closely than I do.

For some reason 1Password didn’t offer my password on the sign-in page. I grumbled about the clumsy bastards who can’t even get their own login right and copied the password by hand. Only then I looked at the domain, and it was accounts.gkoosl.com.

So, what the hell: the first result was an ad, and it led to a page on Google Sites that copies the Firebase website, with the console link pointing to the phishing domain. I reproduced it a few times and took screenshots of the whole circus. Google sold the ad and hosted the page, and the only part of the chain that wasn’t Google was the domain collecting Google passwords. 1Password was the only one in this story who checked the domain, and I was the one arguing with it.

Luckily, I noticed it quickly, changed the password, and the account has a bunch of second factors anyway, so the guys from gkoosl.com would have had to work for it. Still, it’s surprising that OpenAI and Anthropic are competing over the Millennium Prize problems, while Google still can’t deal with phishing that runs on its own products, Ads and Sites. Apparently checking that an ad for Firebase doesn’t lead to sites.google.com is the harder problem.

Oh well.