Only download IPAs from trusted archival sources (like Internet Archive or direct developer mirrors) or extract them yourself from a legitimate Apple ID purchase.