Expected: the moment the download starts, BDR cancels + deletes it and shows a "Dangerous download blocked" notification. Console: DETECTION [high] malicious-script-driveby … from 127.0.0.1.nip.io (suspicious-tld). (A normal .pdf, or an .exe from github.com, must NOT be blocked.)