4 ms·
They're faking the URL too though - https://duckduckgo.com/vpn https://duckduckgo.com/vpn isn't a real site or product - it just redirects to a DDG search for v
by mcintyre1994 9y ago
They're faking the URL too though - https://duckduckgo.com/vpn https://duckduckgo.com/vpn isn't a real site or product - it just redirects to a DDG search for vpn. The page is entirely the attacker's, but it shows DDG's domain with https.
It looks like tranquil-bit.surge.sh redirects to http://tranquil-bit.surge.sh/vpn http://tranquil-bit.surge.sh/vpn so maybe DDG are somehow setting the URL to whatever the u= param redirects to?
- jchw 9y agoThe URL faking is with the HTML5 history API. It's possible to fake any URL on that domain because the JavaScript is executed in the context of that domain.