Monday, December 20, 2010 and are not Wikileaks

At this time of writing, the domains and do not mirror the original content of the Wikileaks Project.
Be warned if you visit these sites.
The domains and lead to a hosting platform of a so called bullet-proof hoster. The hoster and their reseller are known as also hosting phishing and malware sites. This is why Anti-Spam companies like Spamhaus and Trend Micro warned explicitly to visit these sites.

At the moment there is no indication that both websites are used to spread malware. But that may change sooner or later.
If you compare the original Wikileaks at with the fake mirror at it is very obvious that both sites are not related to each other. Only two things are equal among both sites: The logo and the word Wikileaks.
Fake Wikileaks at

Real Wikileaks at
The fake Wikileaks aims to look like the well known Wikipedia but a closer look reveals the differences:
  • No possibility to navigate with the navigation bar on the left.
  • No way to edit pages
  • The search does not work
  • You can't create an account to login
The content of is not available at and vice-versa. One of very few functional links leads to a statement of the Team pointing out that they are not cybercriminals. They say: " will always be safe and clean. Promised".
But do you trust someone claiming to be someone else? Do you trust someone who insist on mirroring Wikileaks but does not? Do you trust them because you know that they are hosted in Russia and/or Panama?
Currently the website is a very "poor" copy of the original Wikileaks. But it is very easy for cybercriminals to copy the Wikileaks project, to have the same layout and the same content pretending to be "the" Wikileaks. In that case it is very hard to determine, if invisible parts of the site are manipulated and are used to infect your local PC.
So trust noone, watch your steps and don't get fooled by the bad guys. Not everything claiming to be Wikileaks is the real Wikileaks.

No comments: