What Gridinsoft observed on warpspeedvpn.com
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20261104160210-95f4e022
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Inconclusive
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The public operator flow did not reproduce phishing or malware. A privacy-document mismatch was confirmed. The available first-party evidence does not establish safety of the executable software or customer-server namespace, so a domain-wide Safe conclusion is not supported. The independent result is inconclusive; external warnings are documented separately, without being presented as reproduced attacks.
Analyst findings
Review 6 documented observations View evidence
The apex and www roots both returned HTTP 301 to https://warpspeedvpn.net/, which displayed a self-hosted WireGuard VPN product. Browser navigation confirmed the destination. Public pricing, documentation and account-page HTML did not reproduce phishing or an automatic malware download.
-
HTTP status
301 - Public artifact URL https://www.warpspeedvpn.com/
-
Redirect destination
https://warpspeedvpn.net/
The installer is directly available on both .com hosts. Static review found an unobfuscated script selecting WarpSpeed 2.1.1, downloading a Linux binary and a checksum from warpspeedvpn.com, comparing SHA-256, then installing and running the binary. The script was read, not executed; binary behavior was not tested.
- Public artifact URL https://www.warpspeedvpn.com/install.sh
- File SHA-256 ce6c1c2cfa58f07f0fa7000b24b6bb804be86ad52895ef891f10f4ce8b845a7b
The linked terms name Bunker Cloud Services LLC as WarpSpeed operator. The linked privacy policy instead describes WireSpeed at wirespeedvpn.com and names Portal Cloud Inc. as controller. The documents leave the applicable product and responsible entity unclear; this mismatch alone does not demonstrate phishing or a legal violation.
- Public artifact URL https://warpspeedvpn.net/static/legal/tos.pdf
- Public artifact URL https://warpspeedvpn.net/static/legal/privacy-policy.pdf
Cloudzy documents customer VPN-server subdomains under warpspeedvpn.com. The DigitalOcean Marketplace also documents WarpSpeed VPN by Bunker. Historical urlscan captures from April 14 and September 8, 2026 show two tenant roots redirecting to their own /signin pages with No classification. Neither product listings nor those captures certify all deployments.
- Public artifact URL https://marketplace.digitalocean.com/apps/warpspeed-vpn-by-bunker
- Public artifact URL https://urlscan.io/result/019d8d33-001c-740b-9b25-bf0c6e2a0a5f/
- Public artifact URL https://urlscan.io/result/01a08182-3de7-760b-afbb-9373bf30d6ef/
OTX associates the specific tenant URL https://vpn-157-245-144-108.warpspeedvpn.com/wp-content/meine with phishing through repeated daily lists from one publisher. This is URL-specific external attribution, not a reproduced credential-capture page or malware sample. Repetition is not independent corroboration; no harmful page body or payload was authenticated.
- Public artifact URL https://otx.alienvault.com/pulse/6aea0488a47635cb43c39830
The August 5, 2025 apex snapshot displays Galaxy | Private Beta, advertising SaaS hosting, subscriptions and customer management. It establishes different historical public content, not a previous compromise, verified cleanup or current software safety.
- Public artifact URL https://web.archive.org/web/20250805114224/https://warpspeedvpn.com/
Scope and limitations
- No binary was downloaded or executed, VPN tunnel tested, account created, form submitted or payment made. Static script review does not certify the installed software or private services.
- Customer-server subdomains were not enumerated or tested live. The exact externally listed tenant path was not opened; its harmful behavior and present content were not authenticated.
- Public-index and sandbox searches are incomplete coverage, not clearance. The reviewed archive establishes only its recorded public page; corporate ownership, historical cleanup and private data handling were not independently authenticated.
Help protect others by sharing this page on social media! The more people who know about warpspeedvpn.com, the fewer chances they have to deceive someone else. Help others evaluate warpspeedvpn.com by sharing this page on social media!