WatchOut
WatchOut #25 · Investigating

Fake "GitHub Setup" download page pushes a suspicious Windows file

Technology & workplace scams

Who may be targeted: People looking to download GitHub or developer software for Windows, especially anyone searching for a download during a GitHub outage.

A dark web page titled GITHUBSETUP using the GitHub logo, offering a Download for Windows button, an archive password of Github, and a Verified on VirusTotal label.
The fake gitappsdown[.]pro page. It shows the download button and the archive password it tells visitors to use. Nothing was covered; the page shows no personal information.

What we are seeing

A site called gitappsdown[.]pro copies GitHub's look and offers a free "GitHub Setup" download for Windows. The giveaway: it hands you a password-protected file and shows you the password, which GitHub never does. Opening it can put malware on your computer. Download GitHub only from github[.]com.

Warning signs

  • The page uses GitHub's logo, but the web address is gitappsdown[.]pro, not github[.]com.
  • It offers the download as a password-protected archive and shows you the password on the page.
  • It tries to look trustworthy with a fake "I'm not a robot" box and a "Verified on VirusTotal" label.
  • The file is unusually large, about 300MB for a simple setup, a trick used to slip past virus scanners.

Reported addresses

Written so they cannot be clicked. Do not retype them into your browser.

  • gitappsdown[.]pro

Learn the full pattern

This alert is one example of a documented scam pattern. Read the full record at ScamArchive.

Send this to someone it could protect.

Get future alerts Report a scam

← All alerts