We released a game for iOS and, somehow, a ton of APK download sites seem to have the APK for the game. We don’t have the game running on Android yet, and one of the reasons for not doing the Android version is that we wanted to see if APK Download sites start talking about the game and start offering downloads. Is it safe to download those APKs online?
Your Answer Upfront:
Downloading APKs online from untrusted sources runs the risk of opening the door to malware on your device. Not all APKs downloaded from sites like APK Pure are harmful but the risk is there and in 2021 APK Pure was found to have contained malware in both the online website and the Android app by Kaspersky.
In this article we’ll start with the game itself. Where it was made available, what sites initially covered it and then we’ll move onto a list of APK download sites that started featuring it. We go over the list of sites and look at the downloads inside of a Virtual Machine to check for viruses and then check it out in an Android emulator.
At the end of the article, we present the lessons learns, we explain why APK download sites exists (and why they are a necessary evil) and offer a list of alternate sites that can be trusted.
Before we start: I will not be linking to those websites and instead, I’ll be using screenshots from their pages so expect this post to be quite image heavy. I do not recommend you visit those sites manually and download anything from them.
Searching for Android downloads for a game that only released on iOS
Intro to the case study on APK Download Sites
We released BSG – Dragon Battle (you can download it for free for iOS devices on the App Store) on January 10th 2022, 2 days ago. The reason the game is completely free with no ads, in-apps or tracking is due to the fact that I wanted to do some case studies to aid players discover new games and for new developers to set their expectations.
At no point between announcing the game or releasing it have we ever made an Android version of the game, not even for testing. It is planned but we’re going to wait a bit (more case studies on the way). And we never reached out or promised an Android port to anyone, not even in the press release. So – how did APK download sites get wind of it?
In order to track backlinks to our blog, we rely on a tool called ahrefs (not an affiliate link). It helps us track how well we’re doing with Best Smartphone Games as a blog and to see who is linking to us. What happens, a lot of times, is that a press release gets copied (scrapped) directly and sometimes the links are copied with the text. There’s very little quality assurance done by owners of scammy sites and they show up in ahrefs.
Let’s see how those websites discovered the game.
The game’s coverage (and where the APK download sites got wind of the game)
The only promotion for the game was a post on this blog (you can read it here if you want) and a press release sent to Games Press (it’s a website that posts press releases). The press release was picked up by PocketGamer (a huge authority site on mobile gaming and game development).
Pocket Gamer’s parent company, Steel Media, also owns 148Apps.com, a website that aggregates new app releases, updates, features and reviews them. It’s a great site and I rely on it pretty often (just like with Pocket Gamer). Info about the game to be released was picked up by 148Apps and aggregated on January 4.
On January 10th the first 4 backlinks from the APK download websites started appearing in our ahrefs dashboard. By the time of writing there are 10 APK download sites that have scrapped the game and 3 iOS download sites – the game launched 48 hours ago :).
Let’s go and check them out to see who these websites are and what do they contain exactly.
APK Sites offering APK downloads of the game
These are 10 APK download sites and 3 iOS sites that have backlinks to this blog.
Website 1
The first website calls itself a Windows App website. it’s in Japanese but I relied on translate.google.com to translate the page. It lists the game as being available for Windows 7, 8, 8.1, 10, 11 + Mac.
The website prominently features a download button just under the game’s icon and “description” with another smaller one to the right side of the screen. It lists the actual app file size as it is on the App Store.
Below this region you can find the “tutorial” on how to play the game using emulators such as Nox or Bluestacks. From the translation, it seems to be a legit method of installing the APK file in those emulators (keep in mind the game has no Android version).
In order to check the download we’re going to rely on a virtual machine. I have installed a copy of Ubuntu 21.04 in VirtualBox and we’re going to check them out under virtualization to keep my main computers safe.
Clicking any of the Download buttons will lead you to a page with two possible options + a tutorial on how to install an emulator. The two options are:
- Download for Android
- Download from iTunes.
Clicking download from iTunes takes you to the game’s page on the app store. This is okay.
Clicking download for Android redirects you to a URL Shortener which, after displaying ads for about 15-30 seconds, takes you to a website titled apkpure while passing the game’s name as a search parameter.
Nothing available to download from there. Onto the next website in the list.
Website 2
The second Website on this list is pretty similar in content to the first one – it just has a different theme applied to it and is in Korean. It lists the game as available for XP, Vista, 7, 8.1 and 10 but other than that it’s identical. It even has the same Bluestacks and Nox tutorial.
The same behavior can be observed BUT, instead of linking us to apkpure, it links us to uptodown.com. Sadly, they are also sending us to a game called Dragon Battle for Android, made by Tap Pocket/Tap Monkey. Close, but no cigar. I still downloaded the APK just to run it through a few virus checking software.
VirusTotal also returns the file as being clean. Running the game in Bluestacks yields to be what I thought it to be (Dragon Battle by Tap Pocket). An APK of the game as it is on the Play Store.
Website 3 -> 13
At this point, I started opening up all the websites at the same time. They’re all the same websites, err mostly. Or better said, they all share the same two templates as a base. One of them is up on Code Canyon, under the name of “App Store – iOS iTunes App Affiliate script” for a price of $29 (I’m not linking to them out of principle).
At best this is a bit of misleading advertising to garner clicks in order to display ads.
A lot of these websites actually made sure to feature a link towards the original game on the iOS App Store, even saying “Download it for free from iTunes”.
Is this good for my game’s discoverability? I doubt it. Especially since they theme themselves as being Android oriented and they’re all linking a game that’s for iOS. If anything, this can annoy players that are interested in the game and that are searching for it.
So let’s see what we can learn from all of this.
Lessons Learned
- All APK download and mirror sites that we tested link to the same 1-2 websites that actually host the downloads
- All these APK mirror sites that feature the game are based on the same templates and exist only to earn money from advertising and bring no actual value to the table (like most of the mobile gaming industry releases)
- They don’t bring any usefulness to the developer/publisher in promoting the game and can actually hurt a website’s credibility (this blog for instance) with links set to Do Follow. I now need to go and disavow on Google a lot of those links (and those that will follow) since I don’t want Google/Bing/Yahoo/DuckDuckGo to think I approve of their practices.
Now, all these sites that have began scraping the game and offering fake downloads? They were 13 when I started the post. They’re 3 more that have been added as I typed it.
Probably by the time the game reaches a month of being live on the App Store they’ll be over a 100. Imagine how interesting this initial case study will become once we release an Android version of the game.
Cautionary Tale
However, there is something that irks me on this whole affair. The fact that most of these sites rely on Apkpure, UpToDown or APK Mirror. And the fact that the same 1-2 templates/scripts are shared by most of them.
There are probably hundreds of these sites out there (as that template that I showed earlier has been selling for five or six years and has hundreds of comments). The last time the template has been updated by the developer has been in 2019. So, if a vulnerability is found, there are going to be hundreds of websites that can and will suffer from it.
So even if the APKs they link to are clean and virus free, it doesn’t mean the website is. And even if the site is clean and no vulnerability is even found, they’re still a big problem: They all link to the same APK hosting sites.
Just last year Kaspersky released a statement mentioning they found trojans infecting the website AND store app for Android. Read the entire article here on Kaspersky’s blog, they have some good points on how to protect yourself from Trojans and other viruses if you’re downloading APKs from the web or unofficial channels.
Are the APKs made available by the APK download sites full of viruses?
You know how every few months the Play Store is condemned for hosting malware and trojans? If Google, with millions of dollars at their disposal, can’t guarantee safety, what can APK Pure do? We couldn’t find any viruses and trojans in the APKs we downloaded for this post, but that doesn’t mean there are none.
One good tip I can give you is to check the file download size and cross reference it with the size from Play Store. If it’s different, be wary. You might be downloading something else.
Why do sites like APK Pure exist? Why isn’t APK Pure banned?
APK Pure and other APK mirroring sites aren’t a bad thing per se. They are amazing when the official channels aren’t available. Some Android smartphones out there come without the Play Store and alternate channels for downloading things are needed so they have their merits.
They can also serve as software archiving websites. If a publisher/developer (yes even me) decides to muck about with the game and the recent updates break and change your favorite things, using Google Play you can’t actually download an older version. But you might get lucky and have it available on these alternate stores.
People that use these sites can also bypass geo-restrictions. They are useful when a developer is not sure he wants to spend too much money on a game and just releases it in “soft-launch” to see if it’s worth developing further. If they launch in soft launch in NZ, people from EU or US or other parts can’t download the app.
Why shouldn’t I download a free APK from APK Download Sites?
If the APK is available for free from the Play Store then there’s no reason not to download it straight from the developer. Exceptions are available as the aforementioned geo location bypassing or older version of the app.
However, in a lot of cases, free APKs are stolen from the Play Store and their ad code is replaced with a new one. Not only is the original developer not getting any revenue but you’re still getting a lot of ads (and in some cases, worse and more dangerous ads).
Another reason not to download APKs from untrusted sources is that they can contain malware which can harm your device, spam your entire contact list and steal your data (bank account, transactions, login information to various websites and services).
Is it safe to install cracked APKs?
If the APKs content (usually the game) is altered you’re going to get a different experience than what the dev intended. A lot of people download modded or cracked APKs to get access to cheats (like infinite money, lives, content unlock, faster progression) however you also run the risk of downloading even more malicious stuff like viruses and trojans bundled with the app/game.
Alternative Stores to Google Play
If you’re looking to take a break from Google Play’s content there are a handful of LEGAL, alternate stores from where you can obtain new (and different) games than what Play usually features.
- Itch.io is an amazing place to get free and premium Android Games (usually without ads or IAPs)! Yours truly even has a couple of Android games available there (though I’m not going to link to them. Happy hunting 🙂 ). Itch.io is an alternative storefront for experimental indie games and game creation tools but can feature a lot more content, like Music and Books. A great place to discover new gaming delights.
- Amazon App Store for Android is an alternative to Google Play. Features a bit more curation that Google Play but also has less content. Sometimes they offer discounts that are not available on Google Play and even feature content that’s yet to be released on Google Play.
- Samsung Galaxy Store is Samsung’s answer to Google Play. It comes pre-installed on most Samsung devices but has a really small selection of titles. However, they are known to be tested on Samsung devices so if you own such a phone or tablet – you have just a tiny bit of a guarantee that the game will perform decently on your device.
Is it safe to download APKs online?
Downloading APKs online from untrusted sources runs the risk of opening the door to malware on your device. Not all APKs downloaded from sites like APK Pure are harmful but the risk is there and In 2021 APK Pure was found to have contained malware in both the online website and the Android app by Kaspersky.
Where to next?
Congrats, you’ve made it to the end of the article! We write extensively about mobile games and we have a handful of them to recommend. Check out this article where we recommend games that you can play with your kids, aptly titled “Best Smartphone Games You Can Play With Your Kids”. We also have a lot of reviews up for quite a few games, like this one about Metal Slug Attack.
If you want to stay up to date with our articles, make sure to give us a follow on twitter or subscribe to our mailing list (we promise to not spam you and only send emails when we have something truly unique and worthwhile). Or, leave a comment below telling us what premium or free smartphones games you enjoy!
2 thoughts on “Is it safe and legal to download APKs online?”