Help needed: report the fake phishing site koboldcpp.com

[LostRuins]

Hello KoboldCpp users.

Over the last few months, the KoboldCpp community project has been struggling to combat the malicious website at koboldcpp.com.

Unfortunately, in the early days, we did not secure the domain name koboldcpp.com, which is now held by cybersquatters. They have AI generated a fake scam website impersonating branding for KoboldCpp to mislead visitors into downloading malware through javascript triggered pop-ups. The fake website uses blackhat SEO techniques to rank highly in the search results, sometimes even surpassing the official KoboldCpp github in search results.

We have tried various methods such as contacting the hosting companies, but they simply move to a different webhost and try again.
We have also tried contacting google directly to delist them, unfortunately so far our attempts have been ignored.

---

What you can do to help:

1. First, report koboldcpp.com to google. More reports might help this issue be taken seriously.

   • Report it in search quality feedback form as spam
     • https://search.google.com/search-console/report-spam
   • Then report as a malicious phishing website to google safebrowsing and microsoft safebrowsing (social engineering).
     • https://www.google.com/safebrowsing/report_phish/
     • https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site

2. Second, in the Google search results for 'koboldcpp', click the 3 dots to give feedback that the fake website result koboldcpp.com is spam / inaccurate / irrelevant. Avoid actually visiting that site (do not bring them traffic), you should visit the official github instead.

3. Finally, if you happen to know any contacts who can help from Google (Search), the domain registrar, the webhost or similar resources, let them know about this issue and see if they're able to help. Also, feel free to report it to other safe browsing web resources you may know, web of trusts, review websites. Spread and use the real Github URL here. And avoid visiting or hotlinking the fake website.

This issue is causing us a lot of stress, so your help really means a lot. You can contact me on Github (LostRuins), DM me on reddit u/HadesThrowaway or discord @Concedo

Thanks for the help! And remember, the legitimate location of the KoboldCpp project is at the official github at https://github.com/LostRuins/koboldcpp and the REAL website is at https://koboldpp.net

[duynt575]

Done. Hope that others will report too.

[LostRuins]

Thanks! There's one more place to report I just added too https://search.google.com/search-console/report-spam

Your help means a lot

[underscorex86]

aye aye cap'n

[MrJackSpade]

The registrar abuse contact is abuse@spaceship.com

https://www.spaceship.com/legal/how-to-report-abuse-incidents-in-spaceship/

Registrar Information
Registrar: Spaceship, Inc.
IANA ID: 3862
Email: support@spaceship.com
Abuse Email: abuse@spaceship.com
Abuse Phone: +1.9854014545

https://www.whois.com/whois/koboldcpp.com

EDIT:

Cloudflare is managing the DNS, You can contact them here

https://abuse.cloudflare.com/

The IP is owned by Spectra, here is their abuse contact

abuse@spectraip.nl

[LostRuins]

We have already tried contacting SpectraIP, but our emails were unanswered.
More reports to cloudflare might help. I'll add that to the suggestions

Edit: seems like they're not using cloudflare?

That said, feel free to report them to the web host too! More reports might help bring more attention to this issue.

[Conduitry]

They're not proxying their site content through Cloudflare, but they are using them as their DNS provider.

$ dig ns koboldcpp.com

; <<>> DiG 9.20.24-1ubuntu0.3-Ubuntu <<>> ns koboldcpp.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35720
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;koboldcpp.com.                 IN      NS

;; ANSWER SECTION:
koboldcpp.com.          86400   IN      NS      jacob.ns.cloudflare.com.
koboldcpp.com.          86400   IN      NS      zoe.ns.cloudflare.com.

[LostRuins]

Yup I checked, seems like cloudflare can't do much if its just DNS lookup. They only deal with cases that proxy through them. I did find another place to report though, at https://search.google.com/search-console/report-spam

[MVoloshin]

Report link for Yandex (if anybody uses it):
https://yandex.com/support/search/en/troubleshooting/delspam

[MVoloshin]

Done. P.S. Also noticed koboldcpp.store and koboldcpp.org (be careful, maybe they need reporting too)

[LostRuins]

Yeah that one is fake too, but it doesnt rank well so im not so worried
The known list of fakes are at https://www.reddit.com/r/KoboldAI/comments/1rwugta/fake_website_thread/

[LostRuins]

One more place we can report: https://search.google.com/search-console/report-spam

[MrBabai]

Reported. Also you can report search results in a Yandex too.

[superskirv]

Submitted, hopefully they do something.

[EclipsedStar0]

You can also report it to duckduckgo's search engine

[hum-ma]

Sent. How about koboldai.com ?

[LostRuins]

That one is legitimate

[bojogon7]

Consider adding to https://github.com/uBlockOrigin/uAssets/blob/master/filters/badware.txt

[LostRuins]

Created the request at uBlockOrigin/uAssets#34648

[rtcvb32]

Glanced over the site.

• At a glance it doesn't ask for information or donations
• 'contact us' is blank and incomplete
• the download(s) point to LostRuins github files unless I'm missing something (https://codeload.github.com/LostRuins/koboldcpp/zip/refs/heads/concedo)
• The site setup looks like it was AI generated from the layout.

I'd guess this is a fan set up page, or maybe a company that sets up the basic framework and placeholder and likely will sell you the domain/site setup after a couple years (as it costs nothing to run other than registration, probably as they host other basic pages from the same server), which is better than actual scammers injecting malware.

[LostRuins]

It's not, you don't see the malware because you have AdBlock.

If you open the page without adblock, clicking anywhere will open a popup with malware downloads instead

[LostRuins]

@rtcvb32 sorry if i wasn't clear enough, if you disable adblock, this is the kind of malware popups you'll see (it's random. don't actually click on them, it will give the scammers revenue)

[rtcvb32]

Yeah I have ublock and noscript on, so i didn't see them. Gotcha.

[baldursgit]

Ironically, Windows Defender just flashed a warning and refused to open the presumably legit v1.122.0.0 dld from here. (no probs with v1.114 dld (10June)). VC says it's clean but Windows Defender says unrecognized - don't run. I sort of think that it used to ask me "are you sure about this" first time running a fresh KoboldAI, but with this new business I don't feel too comfortable.

[rtcvb32]

Ironically, Windows Defender just flashed a warning and refused to open the presumably legit v1.122.0.0 dld from here. (no probs with v1.114 dld (10June)). VC says it's clean but Windows Defender says unrecognized - don't run.

I'm sure if they could get away with it, they'd refuse to run anything except signed code...

A few years ago i remember suddenly everything was getting flagged as virus ridden, only to be revised later. And some of the downloads were text files and roms... stuff you can't run anyways. That's quieted down, maybe swarms of complaints made them backtrack... Or they just stopped flagging non-executables.

[henk717]

This has been going on since the beginning of KoboldCpp, its because we refuse to pay $100 a year for a development certificate with our personal name on it. When a release has been downloaded often enough those popups don't happen for people but on new releases it is a thing. As long as you download it from our official github its fine. Just click on More Info to unlock the run button.

[billymambo]

Reported thoroughly... Let's take them down!

[LostRuins]

Thanks for the help! Unfortunately this seems to have backfired and they are even more popular and now outranking the official github on Google, maybe because people keep clicking on the links and visiting them.

[Giddyhu]

Reported. And yes, I also visited them to see what's going on there... But I don't see any pop-ups. uBlock Origin blocks them all.

This is clearly domain abuse. Reported to spaceship and cloudflare too.

[LostRuins]

Thank you. Yes, an adblocker does block the malware links, what breaks my heart is that newbies likely do not have them, they will get tricked and end up downloading malware.

[rtcvb32]

Reported. And yes, I also visited them to see what's going on there... But I don't see any pop-ups. uBlock Origin blocks them all.

Ahh yes, i have heavy script blocking too and ublock. So that may explain why nothing stood out.

[Nthedev]

Reported them. Also take a look at:
https://www.urlvoid.com/scan/koboldcpp.com/
I also reported here: Phishing-Database/phishing#1307
I tried visiting it in brave:

If anyone wants to report it on other sites I'd recommend: https://openphish.com/ (requires you to send an email to report@openphish.com) or just going through the urlvoid list, most of those sites allow you to report phishing.

[NyaraSnst]

Done! Doesn't pop-up for me probably because of Tailscale + DNS, but it's just so easy to tell (for me) that it has been mostly (if not all) generated with the help of a LLM/AI.
Should've been taken down already, to be honest. These websites are a danger for the less-informed...

• Take care!

[LostRuins]

#2499 (reply in thread) these are the examples of the malware they serve in the popups (its random), i realize i didnt actually provide screenshots earlier.

[Micha00000]

[henk717]

Yeah this is the result of us going for blocklist submissions, adblockers protect some users.
P.s. oisd.nl is a great blocklist to have, I have it in my DNS to.

[amirgame197]

Weird that it's been up for months now, despite so many reports to google. Maybe there's just so many phishing websites these days
Safebrowsing & search results report done.

[henk717]

Google doesn't care at all, they also don't care about reading our counter dmca for lite.koboldai.net and have illegally kept that delisted.

[espressoelf]

They probably generate more revenue for Google than you :(

[LostRuins]

For sure, but I've intentionally chosen not to make any money off this. I just don't want newbies to be scammed into a fake malware download

[sero2kk]

Done...

[espressoelf]

Thrown out some reports. At least some sites already block it, see
https://www.urlvoid.com/scan/koboldcpp.com/
https://www.virustotal.com/gui/search?query=https%3A%2F%2Fkoboldcpp.com

The list of not yet blocking vendors / sites could be some inspiration to go to next.

[Goju-Sulfam]

I just reported the site to google, so we'll see what happens.

Have you considered reporting this site to Quad9? They block suspicious domains on their DNS, so it might help.

https://quad9.net/support/faq/#how_to_report

[LostRuins]

Done, reported to quad9.

I've lost faith in the google reports though, if so many people have sent it and they have done nothing, clearly they do not care.

[Goju-Sulfam]

You can also try reporting them to DNS4EU (a service similar to Quad9):
https://joindns4.eu/for-public#report-a-site

[LostRuins]

Thanks to everyone who has helped report! We have finally managed to get the fake scam site koboldcpp[.]com flagged by google safe browsing. The fight is not over yet, but we have won a big battle, and I am extremely grateful for all who have helped.

In other related good news, we finally have our own real and legitimate KoboldCpp community website at https://koboldcpp.net that will hopefully be a good help! Koboldcpp.net provides newbie friendly links to genuine downloads and resources, and it was setup by @Autumnlight02. Do check it out!

Cheers!

[Giddyhu]

More and more websites are being faked. Banks, hotels, newspapers, retailers, reviews... you can't trust search results; it's becoming a real plague.

[LostRuins]

its really unfortunate... google just doesn't care.

[LostRuins]

Bad news - the scammers managed to get koboldcpp[.]com removed from google safe browsing again. I would ask everyone to help report it again on https://safebrowsing.google.com/safebrowsing/report_phish/