SCAM WARNING: koboldcpp.com is a phishing site

[LostRuins]

Warning: koboldcpp.com is a phishing site, do not link to it or download anything from it. You should always download updates from the official github, which is https://github.com/LostRuins/koboldcpp/releases/latest

[teleportpast]

Your warning is a necessary step in protecting the community. While I haven’t personally found active phishing on that site, I did notice that the application file provided there differs from what's available in the official repository releases. The domain itself appears credible and ranks well organically, though.

I have also come across a couple of other sites referencing or using your project (e.g., koboldcpp.store and koboldai.com).

To further protect users and enhance the project's reputation, certain security measures would be extremely beneficial. These should specifically include implementing file signing and integrating official distribution channels.

Suggestions for bolstering user safety also cover:

• Adding digital signatures to your releases.
• Making installation possible via Winget or Microsoft Store (which verifies files).
• Creating even a simple, centralized official landing page.
• Publishing the release hashes openly on social platforms like X or Mastodon for user verification.
• If not already done, reporting koboldcpp.com to its hosting provider (spaceship.com) for these fraudulent practices.

[henk717]

koboldai.com is us so thats not a scam website.
The .store one is extremely shadey.

The koboldcpp domain is NOT credible in the slightest, its misleading our users into thinking outdated source code from February is our product.

I do have koboldcpp.net but nobody found time to make a landing page yet.

Adding digital signatures to your releases.: We on principle do not wish to pay $100 a year for a cert with our personal name on it so we will not be getting a certificate for the exe's.
Making installation possible via Winget or Microsoft Store (which verifies files).: These tend to have content policies and quite extensive checks so the windows store isn't something were targeting currently. They will also probably require a cert which brings us back to the $100 a year for a free project issue.
Creating even a simple, centralized official landing page: If I ever find time to make one it will be on koboldcpp.net
Publishing the release hashes openly on social platforms like X or Mastodon for user verification: Might be interesting but then that would happen on the github release they belong to.
If not already done, reporting koboldcpp.com to its hosting provider (spaceship.com) for these fraudulent practices: We did try that with google and they do not care.

[teleportpast]

Thanks for clarifying these points, and I completely understand the budget constraints around paid certificates.

On a different note regarding user experience, two quick suggestions might help:

1. GitHub Repo: Could you update the repository's "About" section link to point to https://koboldai.com/ instead of the direct releases URL? This would provide users with a better entry point.
2. Website Visibility: On koboldai.com, the download link back to the latest GitHub release is currently a bit hard to find. Making that button more prominent would improve ease of use.

[henk717]

koboldai.com is actually community PR-able if you are interested in improving it.
It runs directly from https://github.com/henk717/koboldai.com

[henk717]

On the hashes part, github already does this so all our official releases on this github have the hashes right next to them.

[teleportpast]

You are correct that GitHub provides hash verification right alongside releases; this checks for file integrity during download. The benefit of external signatures or hashes, though, is security against a bad actor who might gain control of the main repository and replace both the release and its published hash. It serves as a second layer of proof from an independent source.