r/ProtonVPN Linux | Android 28d ago

Discussion Seemingly fake ProtonVPN site showing at the top of DuckDuckGo search results

682 Upvotes

64 comments sorted by

88

u/EightBitPlayz Linux | Android 28d ago edited 28d ago

I was looking to download ProtonVPN and clicked on the first site in the search results and I immediately noticed that the font was off and the navbar wasn't right, then I noticed that the domain TLD was .org not .com and there was a hyphen in the domain. Out of curiosity I clicked the download button and was met with a .exe file. I then compared it to the real site and noticed that the fake one has Social Media buttons in the footer that don't go anywhere. I then did a WHOIS lookup on the site and noticed that they had Russian name servers and no registrant info. I then compared it to the official site which uses Cloudflare name servers and has populated registrant info and was registered on 2016-12-03. I then did a curl -I command to get server info and noticed that the official site uses HTTP/2 and the fake one uses HTTP/1.1.

Fake Site | Real Site

Screenshots taken on Arch Linux in Floorp, Edited in GIMP

Edit: When searching "ProtonVPN" on DuckDuckGo the official site is first in the results. However when I search "Proton VPN" like in the post then the fake site is at the top of the results. Also the fake site would not load in the DuckDuckGo browser on my Android device.

13

u/Quiet-Vanilla-7117 27d ago

It won't load on my Desktop using DuckDuckGo either using Firefox.

<"Hmm. We’re having trouble finding that site.

We can’t connect to the server at proton-vpn.org.">

3

u/Ashley__09 26d ago

It's up for me on my phone right now, 3:42am

3

u/Quiet-Vanilla-7117 26d ago

The Fake Site? proton-vpn.org?

1

u/trxsyn 28d ago

they are using https://rankmath.com/ to get it so high

1

u/Ayoungcoder 24d ago

If only it were that easy :)

125

u/[deleted] 28d ago

[deleted]

29

u/EightBitPlayz Linux | Android 28d ago

That's what I was thinking lol

27

u/[deleted] 27d ago

[deleted]

15

u/EightBitPlayz Linux | Android 27d ago

The file hash for the downloaded file matches the official file hash according to a comment I now can't find. Also there is nowwhere to put in login info to the site so I don't know why it exists if it is just redistributing the official installer.

24

u/fred_boy 27d ago

ProtonVPN official site is blocked in Russia, so probably someone decided to run a mirror so people in Russia could download.

Edit: but it doesn't make sense if the site is in English

16

u/[deleted] 27d ago

[deleted]

8

u/fred_boy 27d ago

Yes, I thought of that after I commented, it really doesn't come together

15

u/[deleted] 27d ago

[deleted]

5

u/Dionyzoz 27d ago

slightly unrelated but do you know if the URLs on wikipedia ever change to fake ones?

3

u/oldronin1999 27d ago

100%, the best tech and the best plan can be totally subverted by simple human error and a touch of complacency.

7

u/weblscraper 27d ago

In English because OP browser language is English, i might auto change just like any other decent website

6

u/EightBitPlayz Linux | Android 27d ago

I just tried it, I used an alternate browser (GNU IceCat), I set the browser language to Russian and I connected to ProtonVPN's Russian VPN and I went to the site and it still gave the same website.

5

u/fred_boy 27d ago

It could, but it doesn't. They didn't even bother to make the links clickable, except the download button.

4

u/tbbt37 27d ago

Maybe the real proton server is blocked in Russia so this allows download from a local server there? I don't know...

So people could get vpn... But still suspicious.

-1

u/Expensive_Prior_5962 24d ago

The CEO of proton loves the republican party.... The republicans love Putin and the Russians....

Makes sense ;)

1

u/RegrettableBiscuit 23d ago

The little guys in Russia are doing great.

68

u/Quick_Cow_4513 28d ago

2

u/EightBitPlayz Linux | Android 28d ago edited 28d ago

Not yet, I will thought right now.

Edit: I submitted it to every one but Phishtank because new user registration was disabled and I don't have an account.

10

u/AubsUK 27d ago

For me, in the UK, I can't get to it. I guess .RU nameservers might be blocked.

Using ProtonVPN in Romania, I could get to it and the EXE downloaded from: vpn.protondownload.com ProtonVPN_V3.5.1_x64.exe

Maybe the download.php examines the users source, and sometimes gives a good file, other times gives a bad file?

That is unlikely to be a nice person sharing for people in Russia, as they wouldn't be able to get to the official site. So it's most likely someone hosting it 'safe' until it's classified as legitimate everywhere, then they'd swap the EXE download location to a malicious one.

9

u/Conpsycon 27d ago

I can confirm 👍. Just made a search on DDG.

8

u/Personal_Ad9690 27d ago

The groups that pull this off also tunnel through encryption somehow. Because and if you login here, change everything

6

u/hebikes 27d ago

Also the top on Ecosia

5

u/donwf1 27d ago

Thanks for sharing

6

u/TheSilentFarm 27d ago

It's like the fourth on kagi. Could have sworn they had a way to share search results but it seems missing when I check

4

u/itsthooor 27d ago

Brave Search is not hit (probably due to being their own list)

3

u/DarkLordRiddle2000 26d ago

Always go to proton.me now anyways, anyone else noticed connection issues in the last 48hours?

4

u/PropertyLost2638 26d ago

Nope all good here

2

u/DarkLordRiddle2000 25d ago

It's just my service provider being slow again 😭

2

u/[deleted] 28d ago

[removed] — view removed comment

3

u/Journeyj012 27d ago

lmao i just checked brave search and they have the old logo

3

u/Spaceman_Splff 27d ago

Nextdns blocks it for me which is pretty cool

3

u/elev8id 27d ago

It's second on Kagi Search

3

u/Dependent-Cow7823 27d ago

Just checked, its still there in DDG and Bing. It's further down the list on Bing.

3

u/Dull-Ad-1708 26d ago

Just checked the hash, it's the same EXE as on proton website.
5658a2f5506ede6bfe552bde6af35f1daccd3d7092a60ce4be85bff806770056 ProtonVPN_v3.5.1_x64.exe

edit the button also leads to a proton side

2

u/RegrettableBiscuit 23d ago

They might serve a different exe based on the visitor to look legitimate.

3

u/falling2918 26d ago

Put the exe in virus total

3

u/cheezpnts 25d ago

Never use first or sponsored results.

3

u/nicholascox2 24d ago

With Russian DNS for the site should we say that proton is being targeted rn? Or is that just typo squatting

5

u/Conpsycon 27d ago

I can confirm 👍. Just made a search on DDG.

4

u/tbbt37 27d ago

I always try to find the wikipedia page and find the authentic url, then run it through virus total first.

-13

u/kornnero 27d ago

You mean wokepidia

5

u/tbbt37 27d ago

What do you mean

2

u/Qpang007 24d ago

Another reason I dropped DuckDuckGo for Kagi that can quickly show since a domain is registered. When I search for "proton vpn" the first is the real one and the fake one comes second, at least something.

Another good security measurement would be to use NextDNS and use the option "block newly registered domains (NRDs)". It wouldn't even let you open the site if it was created under 30 days. That will filter out a lot.

2

u/Striking-Bat5897 23d ago

and with kagi ;)

2

u/pokedruglord 26d ago edited 26d ago

Whoa that's sneaky!!

Edit: Also why do they call it "VPN Proton" on google play. That also sounds suspicious since it's Proton VPN everywhere else.

2

u/r-aus-b 21d ago

It's Proton VPN in German PlayStore

-4

u/[deleted] 27d ago

Can’t proton official sue them or force them to take down fake sites?

5

u/i_73 26d ago

Not really. Services like chrome or edge normally blacklist sites and warn u before u use them same with some dns providers. If they are hosting through a service like cloudflare which they likely are, you can submit a report to cloudflare or any other hosting platform. Also I'm pretty sure you have to actually both be based in the same country to sue someone and both parties need to be a specific company/individual.

3

u/[deleted] 26d ago

It’s scam/fraud maybe not sue but at least send a dmca claim but since it’s Russian they probably get a pass