Fake download sites turn a click on Download into a file the visitor runs.
Fake software download sites copy the pages of free Windows tools on look-alike domains. Their Download buttons fetch a ZIP from a server the site looks up at click time, and the page then walks the visitor through extracting and running it. Since 1 August we have matched this code on 20 sites.
Fake software downloads in numbers
Since 1 August, when our rule-match records begin, counted on 12 November 2026. How we count.
| Sites with fake download code | 20 |
|---|---|
| Sites with a match in the last 30 days | 20 |
| Named kits | 1 |
Smart contracts
One of these kits reads 2 contracts on Base. Today they return 2 destinations.
A fake download site copies the page of a free tool and puts it on a domain close to the real one. A visitor who clicks Download gets a ZIP the operators chose.
look-alike download page
-> Download button runs a script, with no file link
-> script looks up the current download server
-> ZIP saved to the visitor's computer
-> page shows steps to extract and run itThe button holds no file link
FileDrop copies BleachBit, FileZilla, Notepad++, OBS, ShareX and other free tools. Its Download buttons point at # and call a script. The script reads the download server from a Base smart contract at click time, so the operators can move every site to a new server with one transaction.
The server hands out a one-time ticket for the ZIP after an encrypted handshake.
Other fake download pages rewrite the links instead. A script named download-redirect.js, found on a fake Notepad++ site, decodes a Base64 value into the address of a ZIP on another host and points every installer and GitHub release link on the page at it. A Chinese "WR software center" page offering Microsoft Teams sends all six of its download links to one teams-x64.zip in an Alibaba Cloud storage bucket.
The page tells the visitor what to do next
While the ZIP downloads, a full-screen box lists the steps: wait for the download, extract the ZIP, open the folder, then run the file it names.
What we see across these sites
| Month | New sites |
|---|---|
| September | 0 |
| October | 2 |
| November so far | 18 |
Checking a download page
Before running anything from a download page, check:
- the domain against the project's own site, linked from its source repository or Wikipedia entry
- whether the Download link points at a file, or at
#with a script behind it - requests to blockchain RPC services after the click
- a full-screen "How to install" box that appears with the download
Treat any computer that ran a file from one of these ZIPs as compromised.
Kits
FileDrop
20 sites in the last 30 days
FileDrop is a kit for fake software download sites copying BleachBit, FileZilla, Notepad++, OBS and other free tools.