Safety & Trust
How to Spot a Fake or Cloned APK
Clones reuse the name and icon but never the signing key. Seven checks that expose the difference.
Why clones exist
An app with search demand and no official store presence is an ideal clone target: users already expect to download it from an unfamiliar site, so an unfamiliar site raises no alarm. The clone keeps the name, icon and screenshots and adds whatever the repackager wants.
The seven checks
1.Package name
Inspect the applicationId. Variants with extra suffixes or a different domain segment are repackages.
2.Signing certificate
Compare the SHA-256 signer fingerprint against your existing install. A mismatch is definitive.
3.Permission diff
Clones commonly add SMS, contacts or accessibility permissions the original never requested.
4.File size
A build substantially larger than every other mirror's copy usually contains added components.
5.Advertised platform support
A page offering an iOS build of an Android-only app is describing something impossible.
6.Version plausibility
A version number far ahead of every other mirror is a marketing invention, not a release.
7.Page behaviour
Multiple download buttons, forced redirects and countdown timers indicate a monetised mirror rather than a distributor.
Worth knowing: The package name is the strongest tell: clones must change it or alter the signature, because Android will not allow two identically-named, differently-signed apps to coexist.