Repository navigation
Who's behind https://dotnet-install.sh ? #419
Description
Activity
This looks fishy. Please, download scripts only from Microsoft domains. We now support GPG detached signing so you can check integrity of the file before you execute it.
Reacted by Farhad Alizada and Cole TobinWhere did you find that link?
The only valid alias for that file is https://dot.net/v1/dotnet-install.sh. Now that we only have one version, we could even just shorten the alias.
Reacted by Farhad Alizada and Weihan LiI attempted to revisit the official reference documentation for the script I had read before. I typed
dotnet-install.shinto Firefox's address bar, expecting it to either bring up the relevant page from my browsing history or default to a Google search if the phrase wasn't found. Firefox recognized it as a domain name and, to my surprise, displayed a scriptThe same thing happened to me, I was trying to search for information about dotnet-install.sh, and in my case, Chrome recognized it as a file and downloaded it.
It is easy to fall in to this trap, I was trying to search for information and downloaded an unknown .sh file from the internet.Gotcha. Thanks for the additional context! Was just trying to understand if there were any sites promoting this other domain.
Do we have any updates on this ticket?
FYI:
.sh | country-code | Government of St. Helena
The registrar is NAMECHEAP
The NS is hosted by CLOUDFLARE
A[AAA] records resolve to IPs in AS13335 CLOUDFLARENET
Source: https://www.nslookup.io/domains/dotnet-install.sh/dns-records/- locked and limited conversation to collaborators
on Jun 11, 2025
It seems to download a version of the script that appears to be outdated compared to the official one. Is this possibly a preparation for a bait-and-switch tactic, or could it just be a well-intentioned effort to provide a convenient shortcut for the community?
https://dotnet-install.sh
https://who.is/whois/dotnet-install.sh