I was looking at the documentation, then searched something related to the documentation, and somehow ended up on whonix (dot) ink (not whonix.org!). The website looks the same, except the documentation has slightly different information, maybe outdated.
This is a website impersonating the official one, right? They use Apache while you use nginx, they don’t have a robots.txt while you do, their certificate is different and the SAN only has the main domain while yours has all subdomains (forums., mail., admin., etc…), different documentation contents, couldn’t find any mention of the domain anywhere else, etc…
I’m not gonna use it, but I got curious and now I want to know for sure, since I’ve never seen what looks like an actual honeypot. Maybe they’re hosting modified Whonix images…
Mod edit: Obfuscated the malicious domain name a bit to make it harder to copy-paste without being careful.
1 Like
whonix (dot) ink is a malicious lookalike site.
The official download page for Whonix’s VirtualBox image (Whonix for Windows, macOS, Linux inside VirtualBox) has you download an OVA file, while the .ink site has a very broken (content-gutted?) page that has you download a Whonix.exe file. Whonix does technically have a Windows installer, but it’s not fully developed, certainly isn’t advertised where we put our VirtualBox images, and isn’t named Whonix.exe. Beyond that, the file is only 10.5 KB, which is massively too small to include a copy of VirtualBox and the Whonix VM images that our installer bundles.
I threw the file at VirusTotal out of morbid curiosity (VirusTotal), and there are lots of things wrong with it (it’s a .NET app for one, but our installer is written in Free Pascal, the original name of WindowsFormsApplication1.exe is not something we name our executables, the file version of 1.0.0.0 is wrong, and it apparently tries to detect if it’s running in in a virtual machine which our installer doesn’t do). So… yeah. Not good.
1 Like
FYI, I’ve sent an abuse report related to whonix (dot) ink to Namecheap.
EDIT: As of 2026-09-27, the impersonating website appears to have been taken down.
1 Like