@Sampei.Nihira (and
@Shadowra may be nice to known when you ever test it and make a video)
Improved look-alike heuristics, here is a short read of all the checks performed by download sentinel. These rules are based on the rules of thumb of my former neigbour (who was a security epert at Dutch digital national security agency) and developed further with ChatGPT and Claude.AI.
DOWNLOAD SENTINEL
Every time you download a file, Download Sentinel quietly runs a set of quick checks. No single check is proof of danger on its own; instead, each one adds or removes a few "trust points," and the final total decides whether the file looks Safe, Questionable, Suspicious, or Malicious.
1. Does anyone else already know this file/site is bad or safe?
- Reputation scan (VirusTotal): Checks if security companies around the world have already flagged this exact download link as malicious, and how long it's been known about. A link seen and confirmed clean for weeks is trusted more than one that appeared an hour ago.
- DNS blocklist check (Quad9): Checks the website's address against known lists of malicious domains — similar to a phone number being flagged as a scam caller.
2. Is the website itself trustworthy?
- Domain & website-ending checks: Some website names and endings (like certain unusual .xyz-style suffixes) are used far more often for scams than legitimate ones, so a match lowers trust.
- How new is the website?: Scam sites are often thrown together and abandoned quickly. A domain registered only days ago is treated with more suspicion than one that's existed for years.
- Look-alike names: Catches tricks like fake Microsoft/Apple/PayPal-style addresses, confusable letters (e.g. "m1crosoft"), or oddly long chains of sub-addresses designed to fool the eye.
3. Is the file itself hiding something?
- File type vs. label mismatch: If a site claims to be sending a photo but is actually sending a program, that mismatch is a red flag.
- Disguised file endings: Catches tricks like "invoice.pdf.exe" — a program pretending to be a harmless document by hiding its real ending.
- Raw scripts: Bare scripts are a common way to sneak malicious commands past you. A home user has little to no reason to download scripts.
- Unusually large files: Very large files can't be fully scanned by reputation services, so they're flagged as "check this yourself before trusting it."
4. Is the connection itself risky?
- Unencrypted connections: Downloads sent without the padlock (HTTPS) can be tampered with in transit.
- Raw numeric addresses: Legitimate services almost always use a proper website name, not a bare set of numbers as the address.
- Risky hosting: Some free/throwaway hosting platforms are disproportionately used to distribute malware, so files served from them are treated with extra caution.
Why only show a warning?
There are three reasons. First not blocking but showing a post download warning (which can be surpressed when it is probabaly safe in the options panel) also provides a 100% guarantee that it will never block a download you really need (e.g. a ticket for a concert in password protected zip-file). Secondly for the Virus Total results Download Sentinel waits maximum of 2 seconds to get the VT-rating. Small executables and scripts will be downloaded in these 2 seconds already. Third reason there are some tricks to start a download as pdf or zip and rename it when download completed as script or executable. Using the post download warning makes this extra heuristics check possible.
Why bother with all this?
Scammers rarely rely on just one trick — a fake site usually combines a new domain, a look-alike name, and a disguised file all at once. By checking many small, independent clues together instead of trusting a single test, Download Sentinel catches threats that would slip past any one check alone, while avoiding false alarms on genuine downloads.
Adviced user actions
When virus total knows the donload URL, the proceed link directs you to Virus Total when, so you can upload the downloaded file itself when the results are inconclusive or different than expected. When the download URL is unknown to VT, the proceed link directs you to hybrid analysis, choose QUICK SCAN (by Metadefender and Crowdstrike next gen), ignore the request to login just comply with usage policy of hybrid analysis.
Why does not Sentinel uploads the file itself to Virus Total (or hybrid analysis)?
Short answer is privacy. The purpose of VT is to spread downloads among its members. (over 70 security companies). Hybrid analysis has a little better privacy policy, but also uses OPSWAT Metadefender (checked by 30 security companies, mostly active in the business/corporate market).
How to use it?
It is not a replacement, but an addition to your download protection layers, e.g. DNS with malware filter protection, Safe Browsing or Smartscreen mechanism of your browser, bad URL extension (e,g. Bitdefender TrafficLight or the extension of your AntiVirus or other like Osprey) nor the system wide download protection of your anti virus. It is just another mechanism to fill in the gaps as posted by Sampei-san
(link to post). Because it is triggered by Chrome signals (on download and filewrite) it uses zero CPU when not triggered (when you look in extensions, you will see that it requires no access at all).
Examples
