I can understand being twitchy but it is so easy to get a domain name that it would literally be no barrier at all to an attacker. Not wanting a binary (especially one that will run with root privs) to come from a domain you don't recognise and trust is understandable. Even then it should be by https with AND/OR a signed package are the first steps to security.

Since IP address ranges are allocated in blocks to ISPs, you can do an IP lookup and discover that this fellow is in the UK using a Virgin Cable connection.

So now we know his ISP too. Useful, eh?

ftp://crisp.dyndns-server.com/pub/release/website/tools/trace-20140126-x86_64-b95.tar.gz works too if it makes you feel any better.