This usually means one of the following:
1. This download is coming from your own site rather than from external site
2. The user has copy-pasted the link in browser's URL input instead of following it on external site
3. The user is using an anonymizer browser or tool (for example, Tor browser)
4. The user has followed the link with 'no-ref' option (especially if he's coming from DataLife Engine CMS)
5. The user has followed plain HTTP link on HTTPS site.