[antisthenes]

> How can the average 7zip user know which one it is?

I dunno, if you type "download 7zip" into Google, the top result is the official website.

Also, 7zip.com is nowhere on the first page, and the most common browsers show you explicitly it's a phishing website.

This is actually a pretty good case of the regular user being pretty safe from downloading malware.

[pibaker]

I feel I need to clarify my earlier comment. I was asking how can a user tell, in general, what is the legitimate website of a software, not just how to know what 7zip.com is malicious.

Are the search removals and phishing warnings reactive or proactive? Because if it is the former then we don't really know how many users are already affected before security researchers got notified and took action.

Also, 7zip is not the only software to be affected by similar domain squatting "attacks." If you search for PuTTY, the unofficial putty.org website will be very high on the list (top place when I googled "download putty.") While it is not serving malware, yet, the fact that the more legitimate sounding domain is not controlled by the original author does leave the door open for future attacks.

[layer8]

One way is to consult the same source(s) where the user learned about the software in the first place.

[sedatk]

> I dunno, if you type "download 7zip" into Google, the top result is the official website.

Until someone puts an ad above it.

[8organicbits]

Sure, but the answer to "How can the average 7zip user know which one it is?" would then be "do a Google search and use uBlock Origin".

[TiredOfLife]

> Also, 7zip.com is nowhere on the first page

In incognito window, for me, it's 3rd result

[antisthenes]

It's possible, although I can't replicate this result anymore.

On google search I don't see it on the first page, and the only sketchy link on page 2 is https://7zip.dev/en/download/.

Bing is worse, since it shows 7zip.com on the 2nd page, but the site refuses to load.

But I am using Thorium with manifest v2 ublock and Edge with medium setting for tracker/ad block.