spotfypremium[.]com[.]mx

spotfypremium.com.mx is an active infrastructure observed on 2026-07-12 with a high risk rating (seed 782410). The domain was registered on 2025-03-15 through Dynadot LLC and resolves to 104.21.73.83, an address owned by Cloudflare (AS13335) located in the United States. Authoritative nameservers are rosa.ns.cloudflare.com and yoxall.ns.cloudflare.com, indicating the domain is fully protected by Cloudflare's DNS and CDN services. The site presents a page titled "Spotify Premium APK v9.0.74.1121 (Todo Desbloqueado) 2025" and is classified as an ecommerce‑type brand‑impersonation campaign targeting Amazon. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS connection. Technology fingerprints show WordPress, MySQL, PHP, Google Analytics, Cloudflare Browser Insights, and HTTP/3. The domain is listed on two public blocklists, has been blocked by PhishDestroy and BLP-Malware, and appears in 23 AlienVault OTX pulses. VirusTotal scans report four of ninety‑five security vendors flagging the domain as malicious. No public evidence of the page content beyond the title has been disclosed, so the exact phishing flow remains unverified. Defenders should block the domain at the network perimeter, add it to URL filtering policies, and monitor DNS queries for the associated IP and nameservers. Continuous re‑scanning of the host and correlation with any new OTX or blocklist entries are recommended to capture potential evolution of the campaign.