01

What a fake download page looks like

Read the address bar before you click anything. Clash Verge Rev has exactly one release page: github.com/clash-verge-rev/clash-verge-rev/releases. Check the domain and the path character by character, because those two strings are where copycat sites do their work. An extra hyphen, a missing rev, and the page itself is a faithful clone.

A few signals settle it on the spot. The download button bounces you through several redirects before a file appears. The site wants you to install a download manager or an accelerator first. It asks you to switch off your antivirus to continue. There is a price, a membership tier, or an activation code somewhere on the page. A real release page sells nothing at all. It is a list of filenames and sizes.

Second-hand copies get checked too
An installer someone sent over chat or parked on a cloud drive needs its own hash check, even when the filename matches exactly.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes
02

Running the hash on each platform

  1. 1

    Windows: certutil

    Open a command prompt in the folder holding the file and run certutil -hashfile filename SHA256. The hash is the first line of output. Some builds print it in byte pairs separated by spaces, which you can ignore while comparing.

  2. 2

    macOS and Linux

    In the macOS Terminal use shasum -a 256 filename. On Linux use sha256sum filename. Both print the hash followed by the filename, and the leading string is the part that matters.

  3. 3

    Compare the whole string

    Put your output next to the value published on the release page and walk through it in chunks of seven or eight characters. Glancing at the first six digits and clicking install is the same as not checking at all.

03

When the release page has no hash

Some releases ship a file list and nothing more. Two weaker checks fill the gap. Open the file properties and look for a Digital Signatures tab, then read who signed it. Then compare the file size against the number shown on the release page, where a gap of a few dozen kilobytes is still a gap. Neither check is as strong as a hash, but together they catch most swapped packages.

One point worth stating plainly: an antivirus warning is not evidence that the file is bad. Proxy software installs a virtual network adapter and rewrites system proxy settings, and heuristic engines watch for exactly that behavior. Your verdict comes from the source and the hash, never from the popup.

  • Domain and path read character by character, not just the top search result
  • Full hash compared end to end, not only the first and last few digits
  • No download manager, no activation code, no request to disable antivirus
04

Common questions

My antivirus flags the installer as a trojan. Can I still install it?

Look at the source and the hash first. If the file came from the official release page and the hash matches, this is almost certainly a false positive, since virtual adapter drivers and system proxy rewrites are textbook high-risk behavior. If the hash does not match or you cannot account for where the file came from, do not install it regardless of what the scanner says.

The release page lists no SHA256. How do I know the file was not swapped?

Fall back to the digital signature and the file size. The signature tab in file properties tells you who signed the build, and a size that differs from the release page by tens of kilobytes deserves suspicion. One thing to avoid: never compare against a hash published by a third-party mirror, because that string is the easiest thing to replace alongside the file.