Fake VPN-client and password-manager look-alikes from one search-poisoning operator (WatchGuard, GlobalProtect, FortiClient, RD Web Access, Bitwarden)

One operator runs look-alike download and sign-in pages for corporate VPN and remote-access clients (WatchGuard Mobile VPN with SSL and Firebox, Palo Alto GlobalProtect, FortiClient, SonicWall NetExtender, Sophos Connect, Citrix, Microsoft Remote Desktop Web Access, VMware ESXi, Veeam) and for password managers (1Password, Bitwarden, NordPass, Proton Pass), and pushes them up search results. A visitor who arrives from a search engine on a desktop browser gets a saved copy of the vendor's own download page; everyone else, including crawlers and most phones, gets an innocent-looking 'independent fan site'. On the copy, the Download button opens a pop-up asking for the VPN server, login and password. The first attempt is always rejected as 'incorrect data', so the victim types the password a second time; both rounds are sent to a collector such as watchguard-ssl[.]online or globalget[.]lol, and the vendor's genuine, signed installer then downloads so that nothing looks wrong. Other variants: a copy of the Remote Desktop Web Access sign-in page that sends the form to winmtr-download[.]org and always ends on a login error, and FortiClient pages where any click downloads a ZIP holding an .hta 'VPN client' that sends the gateway, username and password to blagmatt[.]top. The password-manager look-alikes 1password-login[.]com and bitwarden-vault[.]org belong to the same operator: their decoy pages carry the same site-verification codes as the VPN look-alikes, and the collectors run on the same servers (158.94.209[.]214, nameservers coral.spicas[.]top / harbor.spicas[.]top). Because the real page is shown only to search visitors, a harmless-looking capture of one of these hosts is not evidence that it is safe.