[mcintyre1994]

They're faking the URL too though - https://duckduckgo.com/vpn isn't a real site or product - it just redirects to a DDG search for vpn. The page is entirely the attacker's, but it shows DDG's domain with https.

It looks like tranquil-bit.surge.sh redirects to http://tranquil-bit.surge.sh/vpn so maybe DDG are somehow setting the URL to whatever the u= param redirects to?

[jchw]

The URL faking is with the HTML5 history API. It's possible to fake any URL on that domain because the JavaScript is executed in the context of that domain.