Lookalike sites and fake download buttons: checking you are in the right place

A familiar name in the address proves little when several sites use it. How impostor pages work and how to confirm the real one.

The most common way to end up with a bad installer has nothing to do with clever hacking. A person types a program's name into a search engine, clicks a result that looks right, and presses the largest green button on the page. The page was not the developer's, the button was an advertisement, and both were built to be mistaken for the real thing.

How lookalike sites are built

One technique is typosquatting, a form of cybersquatting that relies on mistakes, such as typing errors, made by people entering a website address. Others include adding a word to the real name ("-download", "-free", "-setup"), or using a different ending on the same name. Since anyone can register an unused domain name, a well-known product may have dozens of addresses containing its name, of which the developer controls one or two. These pages are a common vehicle for phishing, in which attackers deceive people into revealing sensitive information or installing malware.

Fake buttons on real pages

Even a legitimate site can show misleading buttons if it carries advertising. Advert networks serve banners drawn to look like download controls. Useful tells:

• Hover over the button and read the destination shown by the browser. A real download link normally points to the same site or its known file host.
• Advert buttons often carry a small "Ad" marker or a close icon in a corner.
• The genuine link is frequently plain text with a version number and file size.
• If the downloaded file's name does not match the program, delete it.

When several sites claim the same name

The hardest case is a name with no single obvious owner, where multiple domains each present themselves as the real one. This is not limited to software. A clear illustration from another industry is a Traditional Chinese page that asks whether one gaming brand is a scam, setting out what Taiwan's public anti-fraud open data shows, how several domains each claim the same brand name and licence, and how readers can check for themselves (必贏娛樂城詐騙). The page states that it is not run by the brand it discusses and gives the date of its checks. Its method is the useful part for a software user: consult a public record instead of the site's own claims, compare the competing domains, and write down when you looked.

A note on gambling. The linked page comes from the gaming sector and appears here only as a worked example of checking a website. This site does not recommend gambling. Anyone who chooses to play should set a spending limit beforehand and treat it as paid entertainment, never as income. If it stops being fun, problem gambling support is available; in the United States the helpline is 1-800-MY-RESET.

Confirming the real site

1. Arrive by a trusted route. Follow the link from the project's code repository, its encyclopedia entry or documentation you already trust, not from an advert.
2. Cross-check two independent sources. If both point to the same address, confidence rises.
3. Read the whole address. The part just before the first single slash is what counts; a familiar name placed further left or right of it can be decoration.
4. Look for consistency. Real project sites link to documentation, a change history and a way to report bugs. Impostor pages tend to be a single page and a button.
5. Verify the file. A hash or signature check, described in checksums and code signing, catches a wrong file even when the page fooled you.
6. Bookmark it. Once you have the right address, save it and use the bookmark next time.

If you already ran something suspicious

Disconnect from the network, run a full scan with your security software, and change the passwords of important accounts from a different device. If the computer is used for banking or work, ask someone qualified to look at it. Acting quickly matters more than working out exactly what happened.

written by Bram Oosterveld / last revised 2026-11-12