Do you want to download "ids ads: what it is and how to remove it
The 'Do you want to download ids' pop-up is a suspicious prompt appearing on legitimate websites, likely caused by a bug in advertisement delivery services. Security experts recommend closing it without downloading.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If redirects to cdn.districtm.io keep coming back, a free scan can check extensions, programs and browser settings in one pass.
Do it yourself · free Remove Do you want to download "ids ads yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Do you want to download "ids ads: summary
| Name | Do you want to download "ids" |
|---|---|
| Type | Popup, advertisement |
| Affected devices | iPhone, iPad, Mac, iMac, MacBook, etc. |
| Associated browsers | Safari |
| Related domain | cdn.districtm.io |
| Symptoms | A suspicious Do you want to download "ids" popup shows on various websites, sometimes redirecting to cdn.districtm.io domain that does not display any content but asks to open it via an app |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Detection names | No Microsoft detection name is known |
|---|---|
| Distribution | Not recorded in the old report |
| Damage | Not recorded in the old report |
| Evidence | 4 write-ups by security sites; details still limited |
| Domains | cdn.districtm.io |
| Ads shown as | Redirects through ad pages |
| Browsers | Chrome, Edge and Firefox |
| First seen | 9 October 2020 |
| Facts checked | 5 October 2026 |
What the Do you want to download "ids ads ads look like
Do I have an infected iPhone? After clicking a link through Facebook messenger (from a friend who was hacked), I noticed these pop up randomly while surfing safari. iPhone 11 Pro Max. Any help greatly appreciated, this is my first iPhone, just bought it a few weeks ago.
Is Do you want to download "ids ads dangerous?
From our report of Oct 2020 · not reviewed since
Do you want to download "ids" - a suspicious prompt that iPhone, iPad, and Mac users see on various websites
Do you want to download "ids" is a download prompt that users reported seeing on various websites for the past few days.
According to reports, the pop-up is very plain - asking to download something, which is accompanied by a "Download" button. In some cases, users are redirected to the cdn.districtm.io domain, which does not incorporate any content, although it asks to open the link with an application.
So far, the Do you want to download "ids" issue is only affecting Macs, iPhones, and iPads, and seems to mostly come up on Safari web browsers. Nonetheless, it does not mean that Google Chrome, Mozilla Firefox, or another web browser will not be affected in the future.
There is also no consistency when it comes to which sites are affected by this problem, as users reported seeing it on sites that are related to news (Fox News, CNN), recipes, forums (ResetEra), and other random sites, although some cases were only related to one particular website.
Since the pop-up appears on many reputable websites, it is definitely not related to them. So, what is Do you want to download "ids"? Is it a virus? As for now, there is no straightforward answer, although we will try to get to the bottom of it in this post.
Do you want to download "ids" popup does indeed seems suspicious, as unknown download prompts are often associated with a virus or other malware-laden websites. However, considering that it is shown on many legitimate sites, the scenario is highly unlikely.
It seems like that Do you want to download "ids" problem has been affecting many users who use iPhones and iPads to view the online content and visit various websites. Here are a few posts:
Looking at these messages, and considering the suspicious nature of the Do you want to download "ids" prompt, one might assume that this is an infection of an iPhone or another device. Of course, there is a possibility that there is a deceptive app installed on all the devices affected by this issue.
Shady apps might have asked for elevated permissions during the installation process to be able to display over other apps, hence they can show prompts at any time during the operation of the device.
Nonetheless, since the issue began abruptly and is associated with multiple domains, it is highly likely that it is caused by one (or both) of the following reasons:
While it is generally presumed that it is safe to download the file, security experts do not recommend doing so. Instead, you should remove Do you want to download "ids" popup by pressing the "X." When it comes to the solution to this problem, you should clear the browser cache and data, and then scan the device with reputable anti-malware, such as or .
- A bug within ad delivery process. Instead of sending a HTML version of the ad, a TXT version is sent instead, which automatically prompts the download.
- An update within Safari or the way how websites deliver ads. According to ResetEra administrator, the problem to users began after they changed the way ads are shifting around content on desktop.
From our report of Oct 2020 · not reviewed since
Never download files that come seemingly out of nowhere
Safari is a relatively safe browser, along with Apple products.
Even those who attempt to download unknown files will not be able to (even if they will, the file will sit in the "Downloads" folder without being executed). Nonetheless, there are plenty of techniques that can allow the attackers to bypass the implemented defenses, as cybercriminals are constantly working on them.
For example, since February 2020, Apple introduced the notarization process - the developers need to upload their apps to the notary service to check for malicious components and other issues. While this seems to be like a strong attempt to prevent malware, cybercriminals behind OSX/Shlayer managed to bypass this process, and many users got infected by it.
Thus, being careful is always advised - you should never download apps from unknown sources or agree to unknown prompts. If you are not sure about something, simply leave the page and never engage with its contents.
From our report of Oct 2020 · not reviewed since
More from our earlier report on Do you want to download "ids
- Clear web browser data and cache.
- If that does not help, perform a full system scan with powerful anti-malware, such as .
- In case the issue is related to a bug within an advertisement delivery service, the provider needs to take care of, which would automatically make it disappear
- Anyone know what it is and how to stop it?
- Happens on every page on resetera.
Check your browser and PC
- Address:
cdn.districtm.io
How to remove Do you want to download "ids ads
How to remove the Do you want to download "ids extension
Do the browser steps in every browser and profile on the PC, then check Windows for the program that installed the extension.
Step 1: Remove extensions you did not add
Do you want to download "ids often works through an extension, so go through the extension list of each browser:
chrome://extensionsedge://extensions- Extensions and themes in Firefox
Switch suspicious extensions off one at a time and reload the page where the problem shows, then remove the one that stops it, and any other you did not add.
Remember the other browsers and profiles on the PC. If Remove is missing or greyed out, a policy forces the extension, which the policy step deals with. Windows 11 and Windows 10 show the same pages.
Chrome on Windows 11: More > Extensions > Manage extensions. Full procedure with screenshots: Remove a browser extension
Step 2: Uninstall programs you did not mean to install
Open Settings > Apps > Installed apps in Windows 11, or Settings > Apps > Apps & features in Windows 10, and sort the list by install date. Look at what appeared around the day the problem started and uninstall every program you do not recognise or did not choose.
Free converters, PDF and video tools, "system optimizers" and unknown browsers are the usual carriers of Do you want to download "ids. If a name is unclear, search for it before you remove it, so you do not uninstall a driver or a Windows component.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 3: Reset the browser
Finish the browser part with a reset, which puts the search engine, start page, new tab page and site permissions back to their defaults and switches extensions off. Chrome: Settings > Reset settings > Restore settings to their original defaults.
Edge: Settings > Reset settings. Firefox: Help > More troubleshooting information > Refresh Firefox, which also removes its extensions. Your bookmarks and saved passwords are kept, and the menus are the same on Windows 11 and Windows 10.
Chrome on Windows 11: Settings > Reset settings. Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Remove from Google Chrome
Delete malicious extensions from Google Chrome:
- Open Google Chrome, click on the Menu (three vertical dots at the top-right corner) and select More tools > Extensions.
- In the newly opened window, you will see all the installed extensions. Uninstall all suspicious extensions related to the unwanted program by clicking Remove.
Clear cache and web data from Chrome:
- Click on Menu and pick Settings.
- Under Privacy and security, select Clear browsing data.
- Select Browsing history, Cookies and other site data, as well as Cached images and files.
- Click Clear data.
Change your homepage:
- Click menu and choose Settings.
- Look for a suspicious site in the On startup section.
- Click on Open a specific or set of pages and click on three dots to find the Remove option.
Reset Google Chrome:
If the previous methods did not help you, reset Google Chrome to eliminate all the unwanted components:
- Click on Menu and select Settings.
- In the Settings, scroll down and click Advanced.
- Scroll down and locate Reset and clean up section.
- Now click Restore settings to their original defaults.
- Confirm with Reset settings.
Remove from Mozilla Firefox (FF)
Remove dangerous extensions:
- Open Mozilla Firefox browser and click on the Menu (three horizontal lines at the top-right of the window).
- Select Add-ons.
- In here, select the unwanted extension and click Remove.
Reset the homepage:
- Click three horizontal lines at the top right corner to open the menu.
- Choose Settings.
- Under Home, set your preferred homepage and new tab settings.
Clear cookies and site data:
- Click Menu and pick Settings.
- Go to Privacy & Security section.
- Scroll down to locate Cookies and Site Data.
- Click on Clear Data...
- Select Cookies and Site Data and Temporary cached files and pages, then click Clear.
Reset Mozilla Firefox
If clearing the browser as explained above did not help, reset Mozilla Firefox:
- Open Mozilla Firefox browser and click the Menu.
- Go to Help and then choose Troubleshooting Information.
- Under Give Firefox a tune up section, click on Refresh Firefox...
- Once the pop-up shows up, confirm the action by pressing on Refresh Firefox.
Delete from Safari
Clear your web data on Safari in the attempt to remove Do you want to download "ids" popup
Remove dangerous extensions:
- Open Safari, click Safari in the menu at the top-left of the screen, and select Preferences.
- Go to the Extensions tab, look for any suspicious entries, and click Uninstall to remove them.
Clear history and website data:
- Click Safari in the menu and pick Clear History.
- Set Clear to all history and confirm with Clear History.
Reset Safari:
- Click Safari in the menu and select Preferences > Advanced.
- Enable Show Develop menu in menu bar.
- From the menu bar, click Develop and select Empty Caches.
Do not let government spy on you
The government has many issues in regards to tracking users' data and spying on citizens, so you should take this into consideration and learn more about shady information gathering practices.
Avoid any unwanted government tracking or spying by going totally anonymous on the internet.
You can choose a different location when you go online and access any material you want without particular content restrictions. You can easily enjoy internet connection without any risks of being hacked by using VPN.
Control the information that can be accessed by government any other unwanted party and surf online without being spied on. Even if you are not involved in illegal activities or trust your selection of services, platforms, be suspicious for your own security and take precautionary measures by using the VPN service.
Backup files for the later use, in case of the malware attack
Computer users can suffer from data losses due to cyber infections or their own faulty doings.
Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact - you can set this process to be performed automatically.
When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use for the data restoration process.
From our report of Oct 2020 · not reviewed since
How to get rid of the Do you want to download "ids" problem?
Since there is no particular explanation to where the suspicious prompt is coming from, users were flooding various IT forums in the hopes of finding methods for Do you want to download "ids" removal.
Unfortunately, if the issue seems to be related to an ad network or other parties. Some users claimed that resetting the web browser or clearing website data/cookies helped to get rid of the problem - check for details below.
If you are using an iPhone, follow these steps:
As evident, Do you want to download "ids" is not a virus or a browser hijacker (like some websites might claim), but most likely a bypass product of complicated ad networks and ad delivery services. In other words, some elements might start acting abnormally, and many users assume that the activity is malicious (similar issues happened with Gstatic, for example).
- Go to Settings and then pick Safari
- Select Clear History and Website Data
- Press Clear.
Questions about Do you want to download "ids ads
What is the 'Do you want to download ids' pop-up?
The 'Do you want to download ids' pop-up is a suspicious prompt appearing on various websites, affecting primarily Mac, iPhone, and iPad users on Safari browsers.
Users report seeing a plain download prompt with a 'Download' button, sometimes redirecting to cdn.districtm.io domain which asks to open the link with an application. The pop-up appears unexpectedly while browsing legitimate news sites, recipe pages, forums, and other random websites.
Is this pop-up a real threat or a legitimate download?
The pop-up is suspicious, and security experts do not recommend downloading the file. However, it does not appear to be a virus in the traditional sense.
It likely stems from a bug within an advertisement delivery service where a text version of an ad is sent instead of an HTML version, triggering an automatic download prompt. While generally presumed safe to download, clicking it is unnecessary and may expose your device to unwanted applications or content.
Why am I seeing this pop-up on reputable websites?
Because the pop-up appears on many legitimate websites including Fox News and CNN, it is not related to those sites themselves. Instead, it indicates a problem with the advertisement delivery network serving ads to these sites.
A bug in the ad network's system causes the download prompt to appear across multiple unrelated domains. The issue began abruptly and affects numerous websites simultaneously, confirming a widespread ad network problem.
Is my iPhone or iPad infected with a virus?
Not necessarily. The pop-up is not evidence of device infection. However, a deceptive app installed on your device could display prompts at any time if granted elevated permissions during installation.
A more likely explanation is that a bug in ad delivery services is causing the prompt. If the pop-up persists after clearing browser data, an unwanted app may be responsible, but a full scan suggests device infection is unlikely.
Could this be an attack on Safari or my browser specifically?
It could be partially related to how Safari or website ad delivery has changed. According to some reports, the problem began after changes to how certain websites shift advertisements around content on desktop versions.
An update to Safari or changes in ad delivery methods could trigger this behavior. The issue is not specific to Safari security vulnerabilities but rather interactions between website ad systems and browser behavior.
What does the cdn.districtm.io redirect domain contain?
The cdn.districtm.io domain does not display any actual content. Instead, it simply asks users to open the link with an application, which is the core of the scam mechanism.
The domain itself is not hosting malware, but clicking and agreeing to open the link with an application could trigger installation of unwanted software or expose your device to potentially malicious apps.
How should I respond when I see this download prompt?
Press the 'X' button to close the pop-up without downloading anything. Never click 'Download' or agree to open links with applications when prompted by unknown sources.
If you accidentally clicked it, clear your browser cache and data by going to Settings > Safari > Clear History and Website Data. Run a scan with reliable anti-malware software to verify no unwanted applications were installed.
How can I prevent this pop-up from appearing again?
Clear your browser cache and cookies regularly to remove tracking data that may trigger ads. Avoid clicking on links from untrusted sources or suspicious messaging apps.
If the pop-up persists, the issue may be related to an advertisement network bug requiring resolution by the ad provider, which would automatically make it disappear once fixed. Keep your Safari browser updated to the latest version for security improvements.
Will Fortect remove Do you want to download "ids?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Do you want to download "ids, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Apple: iPhone 11 Pro Max infected? (read October 5, 2026)
- Ars Technica: The accidental notary: Apple approves notorious malware to run on Macs (read October 5, 2026)
- Google Chrome Help: Use notifications to get alerts (no longer online) (read October 5, 2026)
- FTC: How to recognize, remove and avoid malware (read October 5, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 5, 2026)
- GitHub: Safari trying to download setuid result (prebid-server issue 1477) (read October 6, 2026)