@keepassxc

Of course, there’s no full takedown until the domain is placed on client/server hold. That's correct!

That said, in practice, I rarely see any recovery once Cloudflare puts up a warning page. It’s usually easier for the threat actor to register a new domain.

The good news is that this domain has already propagated across most major AV vendors, and I’ve shared both the domain indicators and the associated malware samples with several partners and information-sharing networks (Quad9, GCA, GSE, etc.). That should help ensure any residual risk is blocked at multiple layers.

I'll set up some monitoring for both this domain and any future attempts to impersonate KeePassXC.

@keepassxc

Takedown completed.

If similar sites appear in the future, don’t hesitate to reach out! Always happy to support FOSS projects in protecting their users.

You can also easily report new cases here: https://justguard.be/report

@evaristegal0is

They do it quite often. Actually it's almost the default response to legitimate reports of phishing they receive.

They also send out the report to the actual hosting provider of the content.

Update: everything is back online

According to Hostinger it was due to a false positive suspension of the wrong service on my account

I don't know what that exactly means, but the suspension has been revoked and in the end that's the only thing I was worried about.