Old forum threads on this domain discussed “FakeShareaza” sites and the hijacking of other P2P project sites. Tech news sites such as Tweakers and Techwarrant still link to those threads. Those discussions can’t be recovered, so this page explains the events from published sources.
What happened to shareaza.com
- October 2007: the main server hosting the Shareaza site, wiki and forums went offline. TorrentFreak reported that the SourceForge site was restored from an earlier backup.
- 19 December 2007: shareaza.com began pointing to a site that called itself “The Official Home of Shareaza”. It reused original artwork and promoted a client branded “Shareaza V4”. That client was unrelated to the open-source project and did not connect to the open P2P networks.
- 1 January 2008: older Shareaza versions checked shareaza.com for updates. The new owners used this to present their client as an “update”.
- 3 January 2008: Shareaza 2.3.1.0 was released. It linked to SourceForge instead, closing that hole.
- 10 January 2008: the new owners applied to trademark the Shareaza name. The trademark was later awarded after the developers stopped defending it.
Wikipedia reports that the domain owner was required to sell the domain under a settlement with SPPF, a French phonogram producers’ organisation.
The same pattern elsewhere
In 2009 the website of another P2P client, Lphant, was reported as taken over in a similar way, with a fake “version 4” offered to users. Spanish and French P2P news sites covered it and linked to discussions on this domain.
How to recognise the genuine Shareaza
- Only download from shareaza.sourceforge.net or sourceforge.net/projects/shareaza.
- Ignore version numbers that don’t exist. There was never an official “Shareaza V4”, “V6” or “V7”. Genuine versions follow the 2.x numbering, for example 2.7.10.2.
- Verify the file. Compare the installer’s SHA-256 with a value published by the project. Use our checksum verifier.
- Check the publisher. Inspect the digital signature (if any) and be suspicious of installers that bundle toolbars or “offers”.
Lessons for any software project
- Keep control of your primary domain: registrar lock, renewal monitoring and two-factor authentication on the registrar account.
- Never trust an update channel without cryptographic verification. Signed updates would have stopped the January 2008 attack.
- Publish one stable “canonical” address, as Shareaza later did with its SourceForge address, so users always know where to look.