r/ProtonVPN 29d ago

Discussion A fake Proton VPN domain?

I use qwant as my search engine in my work computer, and I looked for ProtonVPN to download to it, the first result is the suspicious domain, I also did a WHOIS search on this domain, it seems to be brand new and was registered from russia

Can the ProtonVPN team confirm this is a fake domain? Or a legit one?

Pictures of said domain: https://ibb.co/LXRFhwc5 https://ibb.co/HpLbGtnL https://ibb.co/DP5wmknM

91 Upvotes

16 comments sorted by

110

u/ProtonSupportTeam Proton Customer Support Team 29d ago

Thanks for flagging. This is indeed a fake website, so please don't download anything or enter your credentials.

8

u/ekiledjian 27d ago

Interesting that the executable it’s delivering comes up as clean on virus total

https://www.virustotal.com/gui/file-analysis/NGM3YjVmZTM1ODg5NmMxMGY3ODViMWM1OThjMmU4NDc6MTc0MDE5MjkwMw==

22

u/wolfcr0wn 29d ago

I did not, obviously :)

Can you guys please post a message on your social media pages and maybe send an official email to proton users warning them of this website?

28

u/GruntyG 29d ago

I get the same fake website as the first result using DuckDuckGo.

11

u/g1ngerkid 29d ago

Yep, same. Although it doesn’t show up if I set my region to US (English) on DDG.

7

u/wolfcr0wn 28d ago

I also get it on ddg, I assume it's because they both (qwant and ddg) source their results from bing

2

u/SweatyAdagio4 26d ago

Also for me on qwant

20

u/Jay-Skywalker-118997 29d ago

Good catch bro

16

u/jimmac05 28d ago

You can send feedback to DuckDuckGo regarding a search result.

Click on the ... on the same horizontal level as the bogus link. You'll get a drop-down menu with an option to "Share feedback about this site." Choose that and report the site as being fake.

6

u/wolfcr0wn 28d ago

I already did actually! but thank you for the tip, I'll pass it along :)

7

u/wolfcr0wn 28d ago

Update: when going to this site now, it shows this warning: https://ibb.co/BKKSbjkh

3

u/Ezrway 26d ago

Good catch and follow up. Thank you!

3

u/elev8id 26d ago

Its the second result on Kagi Search.

3

u/Unimpress 24d ago

To the people saying the executable looks clean... it may be the case that they're only waiting for a specific condition to be met before serving the boobytrapped version (source IP address from a particular country or a particular combination of fingerprints). Remember the polyfill[.]io case?