subwaysurfmod[.]app

On 22 July 2026, subwaysurfmod.app was flagged as a brand‑impersonation campaign targeting UPS. The domain resolved to the Cloudflare address 104.21.92.46, an IP owned by AS13335 Cloudflare, Inc. and geolocated to the United States. DNS resolution was handled by brenna.ns.cloudflare.com and hugh.ns.cloudflare.com, consistent with the registrar information that lists Cloudflare, Inc. as the registration service. The site presented a page titled “Download Subway Surfers (MOD, Unlimited Coins/Keys)”, indicating a content focus unrelated to the UPS brand, yet the intelligence classification cites brand impersonation, suggesting the domain may have been used to lure UPS‑related traffic or to harvest credentials under the guise of a popular mobile game.

The TLS certificate was issued by Google Trust Services under the WE1 root, confirming a valid HTTPS handshake at the time of capture. Automated analysis identified a WordPress stack with MySQL, PHP, Yoast SEO, jQuery, and Cloudflare’s HTTP/3 support. Gridinsoft assigned a trust score of 0 / 100, and VirusTotal recorded a single positive detection out of 95 scanners, indicating at least one security vendor identified malicious behavior. The domain appears on one external blocklist and was explicitly blocked by the PhishDestroy service.

Current host status is offline, and no further content is reachable, limiting real‑time verification of payloads or credential‑capture mechanisms. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the same IP or hosting configuration, and consider adding the domain to internal threat‑intel feeds. Ongoing observation of Cloudflare‑hosted infrastructure associated with this ASN is advisable, as threat actors frequently recycle similar assets for new campaigns.