I feel ok with the Ethereum and Wave token airdrops, but I won't download a wallet to get an airdrop coin.
This is also a great point. Don't ever download anything or sign up for an account somewhere that isn't well-known. And for heaven's sake, if you do sign up for an account, don't use the same password as your other accounts. Make sure you're using a unique password for just that site so they can't phish your info.