[SUPPORT] Is qownnotes.net an official download?

[SteveF4]

I came across https://qownnotes.net while researching QOwnNotes and want to flag it here, since it seems suspicious:

The site presents itself as the official QOwnNotes homepage, including a download page headlined "Official Download" and "Verified Safe", plus a "Contact Support" page. But is not affiliated with this project as its own footer says: "Disclaimer: Not affiliated with QOwnNotes or any other third-party platforms."

What I verified:

• WHOIS: the domain was created 2026-06-15, registered via Dynadot behind "Super Privacy Service LTD", 1-year term, hosted behind Cloudflare (https://who.is/whois/qownnotes.net).
• The site's "guide" articles are dated before the current domain registration (2026-06-15), i.e. backdated to before the domain was registered.
• It carries fabricated-looking user testimonials (e.g. a reviewer who has "been using QOwnNotes for three years" on an eight-week-old site).
• Download buttons route through the site's own endpoint (/download?platform=windows) rather than linking to GitHub releases directly, so the actual binary source is opaque. I have not tested whether the payload currently matches your release assets.

I checked the Wayback machine to see if the site exited before its registration, but if it did exist it was not captured:

Full WHOIS record:

Field	Value
Domain	qownnotes.net
Registrar	Dynadot Inc (IANA ID 472)
Registrar abuse contact	abuse@dynadot.com, +1 650-262-0100
Status	client transfer prohibited
Registered	2026-06-15
Expires	2027-06-15
Last changed	2026-06-20
Nameservers	angela.ns.cloudflare.com, lennon.ns.cloudflare.com
DNSSEC	not signed

I've been listening to Steve Gibson's Security Now podcast regularly enough that QOwnNotes.net triggered an instinct in me that made we want to flag it here.

[pbek]

Thank you for reporting. I had a similar report #3566 for qownnotes.com. I'm not sure if I can do anything about such fake sites.

[SteveF4]

Beyond reporting, I don't know what can be done about it either. The .com site does look similarly generated but at least it points to your Github project's download page. The .net site is actively deceitful by claiming it is the official source and it presents a zip file instead of linking to your GitHub download page. It could be a form of Hallucination Squatting, where a malicious actor registers a resource commonly hallucinated and uses it for developer supply chain attacks.

[pbek]

I reported it yesterday to the domain registrar.