How to Recognize Fake Mirrors and Counterfeit Installers
A download page can look official and still hand you a repackaged installer. How to verify the binary itself, not just the website.
Most advice tells you to judge the download page. That helps, but the real question is about the file: did this exact binary come from the vendor, or was it rebuilt somewhere on the way? Four checks answer it.
Match the hash to the vendor, not to the page
The only source of truth is the hash on the publisher's own site, not on the mirror you downloaded from. Compute SHA-256 locally and compare. A mirror that serves the untouched original passes. A page that adds a keygen, a wrapper or a language patch produces a different hash by definition, and there is nothing left to argue about.
Read the digital signature, all the way down
- Right-click the installer, open Properties and switch to the Digital Signatures tab.
- Select the entry, click Details and then View Certificate.
- Confirm the issuer is a public certificate authority and the subject matches the vendor's legal name, not a lookalike spelling.
- Check that a timestamp countersignature is present: it proves the file was signed while the certificate was valid rather than later with a stolen key.
- Confirm the product description in the certificate matches what you think you are installing.
Look past the page design
- Domains with extra hyphens, a country suffix or the word download glued to the brand are the default fake pattern.
- Search results and embedded adverts push pay-per-click clones above the real vendor; the official link is usually the plain text result, not the boxed advert.
- A support phone number, an unlock-the-full-version step or a survey before the file means the wrong page.
- Fresh domains with no company details, no address and no history follow the same rule as any other scam, just with an installer attached.
Let the installer prove itself before it touches the system
Run a suspicious setup inside a sandbox first. Sandboxie Plus isolates a single program, and a virtual machine or Windows Sandbox gives you a disposable desktop: install there, then watch for outbound connections, unrequested toolbars or a second process that outlives the installer. A genuine installer shows its own name, asks where to install and finishes. A repack asks you to close your antivirus, offers three toolbars and installs a browser before doing anything.
Verify once, keep the verified copy
When a file checks out, store the hash and the signature note beside it on your archive drive or NAS. The next time the same file appears in a search result, you will not have to re-litigate the same page.