Home / Fake downloads
Distribution risk · mirrors · verification
Search results in this category are full of mirrors, re-uploads and pages that look official until you read the address bar. This page sets out the concrete signals that a download page is not what it claims, and how to check one yourself instead of trusting how it looks.
It is worth being precise about where the danger sits. For a tool of this kind, the usual way people end up with malware is not that the tool did something to them — it is that they downloaded something else entirely from a page dressed up to look like the right one. A malicious mirror wrapping a fake build is the standard failure mode here, and it works because the visitor has already decided to run an unsigned executable and dismiss whatever warning Windows shows. That decision is what an attacker needs, and a fake mirror borrows it.
That is also why most of the advice below is about pages rather than files. By the time a suspicious binary is on disk, the good options are behind you. The cheap checks happen earlier: reading the URL, noticing a redirect chain, and confirming the file is the ZIP this page named.
Ad networks serve creatives styled as download buttons, and mirror pages position them so the largest button on screen is the advertisement. The related trick is offering several — "Download v1", "Mirror 2", "Fast link" — where a real page has one. Multiplied options are not generosity; they route different visitors to different payloads. Read where a button points before clicking it.
A timer counting down before a link appears exists to hold you on the page for ad impressions, and it trains you to click whatever appears at the end without reading it. File lockers go further and gate the file behind a survey or an app install. Neither has a technical purpose: a file that is genuinely being distributed is simply served.
Shorteners hide the destination, which is the entire point of using one for a download. Worse is a chain: the shortener resolves to an intermediate page, which redirects again, and lands on a host with no visible relationship to where you started. Every hop is a chance to swap the payload or to fingerprint you and serve something different.
This build is keyless — no key system in the application, no checkpoint chain, no daily token. A page demanding that you join a Discord, complete tasks or buy a key to unlock the download is describing different software regardless of what it is called. It is also a funnel, because the server becomes where the next fake build gets announced.
Compare what a page claims against what is documented here. A different version number on another host is not, by itself, proof of a fake — that site may be shipping a different build. Treat as decisive a file that does not match the name this page promised, a download that leaves this origin, or a key/ad-gate this site does not use. The changelog records the package hosted here.
An archive shipped with its password printed on the same page protects nothing from anyone. What it does accomplish is preventing your antivirus and any automated scanning service from reading the contents, because encrypted archives cannot be inspected. That is the function it serves, and it is a strong reason not to extract it.
If the download tries to add a browser extension, change your search engine, or install a "PC optimizer" alongside the thing you wanted, you have a repackaged build. Distribution of a small utility does not come with a monetisation layer, and the bundling proves someone other than the publisher modified the package.
Anonymous file hosts and raw URLs on code-hosting platforms are available to anyone, which is why re-uploaders use them. A page claiming to be the official source while serving its file from a general-purpose upload service contradicts itself: whoever controls that upload need not be whoever wrote the page, and the file can be replaced without the page changing.
The published package is a ZIP archive you extract and run. An .exe installer, a self-extracting archive, or a setup wizard with licence prompts is not the documented shape of this distribution. Installers appeal to attackers because they normalise a UAC prompt, a progress bar and a series of screens nobody reads.
The table condenses the sections above into the decision each signal should trigger. Treat any single row as a reason to slow down, and two or more as a reason to close the page.
| Signal | What it suggests | What to do |
|---|---|---|
| Several competing download buttons | Ad creatives or split payload routing | Read the target URL before clicking |
| Countdown timer or file locker | Monetised gate with no technical purpose | Leave the page |
| Shortened link or redirect chain | The destination is being concealed | Watch the address bar; abandon it if it lands somewhere unrelated |
| Discord join or key required | Not this build — this one is keyless | Do not download |
| Version string you cannot match | Repackaged or fabricated release | Check against the changelog |
| Password-protected archive | Contents deliberately hidden from scanners | Do not extract it |
| Bundled extension or "optimizer" | The package has been modified for monetisation | Cancel and delete the download |
| File served from a free upload host | Anyone can publish there; the page is not the source | Distrust the "official" claim |
| Installer where a ZIP is documented | Wrong package format for this distribution | Compare against the download page |
Appearance is not evidence. A convincing clone takes an afternoon, and the cues people rely on — a lock icon, a tidy layout, a logo — are cheap to reproduce. The checks that survive look at where things come from rather than what they look like.
Start with the address bar and read the whole domain, not the part that looks familiar; link text can say anything, but the URL is the fact. Check whether the file is served from the same origin as the page, because a page that claims to be the source while handing off to an unrelated host has told you it is a mirror. If a click sends you through intermediate pages, watch where it stops. Then confirm the package name against the changelog before extracting anything: a different filename or a different origin means the file is not what this documentation describes. The safety page covers what to do with the archive after that.
People arrive at pages like this wanting a ranked list of competing tools. Producing one would be easy and dishonest. This site documents a single build and has no visibility into anyone else's release process, no way to audit what another project ships, and no basis for certifying another team's build integrity. A table asserting that one tool is safer than another would be an opinion dressed as a measurement.
What does transfer between tools is the method. Every check here is about distribution rather than about the software, so the same reading of URLs, package names, redirect chains and archive formats applies whatever you run. Reports of pages impersonating this documentation are useful — send them through the contact page. The current package is on the download page.