How to Spot Fake Download Buttons and Malicious Links

Published 7 October 2026 · All guides

Some of the internet's oldest tricks still work: a big green "Download" button that is really an advert, a pop-up claiming your phone has a virus, or a "video" that turns out to be an app. A few habits make you almost immune to all of them.

Warning signs of a fake download button

There are several download buttons. When a page shows three or four, most are adverts. The real link is usually plainer and sits next to the file's name and size.
The button is labelled "Ad" or "Sponsored", or sits in a box with a small ad-choices icon in the corner.
It sends you to a different website. Hover over the button on a computer, or long-press on a phone, to preview the address before you tap.
It asks you to install something first — a "download manager", "codec pack" or "player update". A video file never needs a special installer.

Warning signs of a malicious file

The file type does not match. A video should end in .mp4, .mkv, .webm or similar. A "video" ending in .apk, .exe, .scr, .bat or .zip is a red flag.
Double extensions such as movie.mp4.exe are designed to fool you when the real extension is hidden.
The size is wrong. A two-hour film that is only 2 MB is not a film.
It asks for permissions it does not need. A video player that wants access to your contacts and SMS messages is not just a video player.

Scam pop-ups and fake warnings

Messages such as "Your phone is infected!" or "You have won a prize!" with a countdown are adverts designed to scare you into tapping. Websites cannot scan your phone. Close the tab — do not tap anything inside the pop-up, including its "close" button, which may itself be part of the advert. If a page keeps reopening, clear that site's data in your browser settings.

Habits that keep you safe

Install apps only from trusted sources — your phone's official app store or the developer's own website, reached by typing its address yourself.
Keep "Install unknown apps" switched off for your browser and messaging apps on Android, and turn it on only briefly for an app you have verified.
Keep your phone and browser updated. Updates close the security holes that malicious pages rely on.
Check checksums when they are published. Some developers list a SHA-256 value for their downloads; matching it proves the file was not altered. The DragoXStream Android app checks its own updates this way before installing them.
Never enter passwords on a page you reached from a pop-up or a link in a message. Go to the real site directly instead.

How DragoXStream Player keeps it simple

On this site, a file's download button sits in the file list next to its name and size, and the player has its own download control. There are no pop-ups, no redirect chains and no installers between you and your file. Advertising appears on the page alongside the player and is not disguised as part of it; the privacy page explains which ad scripts load.

If you think you installed something bad

Disconnect from the internet.
On Android, go to Settings → Apps and uninstall anything you do not recognise or did not mean to install.
Run a scan with Google Play Protect or a reputable security app.
Change passwords for important accounts from a different, trusted device.