How we verify an APK record

“Checked” has a narrow meaning here: we measured the endpoint and, where possible, read the file manifest. It is not a malware verdict and it is not an install test.

1. Endpoint

We send a HEAD request and, where supported, a one-byte Range request to the listed URL. We record the status, final URL, Content-Type, Content-Length and Last-Modified value. When the response is an APK, we read the ZIP central directory and AndroidManifest.xml with byte-range requests. We do not download the whole file, install the app, run it or malware-scan it.

2. Manifest

For an APK we locate the End of Central Directory, read the central directory, then fetch only AndroidManifest.xml. The package, versionName, versionCode, minSdk and permission list come from that file. If the file is a shared binary used by several names, we read one member and label the rest as inferred.

3. Identity gate

G1 asks whether the page name, icon, developer, package and version describe the same file. A shared file, a store-client package or a package owned by another name is a conflict. The page becomes a stop record with no download button.

4. Legal gate

If the record shows cash-play features, the page is a compliance or verification record, not a download page. Online money games are prohibited in India under the 2025 Act and the 2026 Rules, which took effect on 1 May 2026.

5. What we do not do

• We do not install or run the APK.
• We do not malware-scan it.
• We do not test a deposit, bonus or withdrawal.
• We do not verify a company registration.

Every record carries a checked date and a refresh due date. An overdue record is treated as unknown and leaves the index until re-probed.