99yuanma[.]net

This domain, 99yuanma.net, presents itself as a legitimate Android application marketplace, offering downloads for games and apps under the guise of "99安卓网." Analysis indicates the site is designed to distribute malicious APK files, which may contain malware, spyware, or credential-stealing payloads. Users tricked into downloading or installing these applications risk device compromise, unauthorized data access, or financial fraud. The site’s infrastructure and content are tailored to mimic trusted app stores, increasing the likelihood of successful social engineering attacks. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on February 26, 2026, through SHANGHAI MEICHENG TECHNOLOGY INFORMATION DEVELOPMENT CO., LTD., a registrar frequently associated with suspicious domains. It resolves to the IP address 115.238.252.81 and appears on three security blocklists. VirusTotal detection shows 4 out of 95 security vendors flagging the domain as malicious, with classifications including phishing and generic malware distribution. The SSL certificate, issued by 泰尔认证中心有限公司, does not mitigate the risk, as the domain’s content remains harmful. If a user has visited 99yuanma.net or downloaded any files from it, immediate action is required. Disconnect the device from the internet to prevent further data exfiltration or command-and-control communication. Run a full scan using updated antivirus software to detect and remove any installed malicious APKs. Check for unauthorized applications, unusual network activity, or unexpected permissions granted to apps. Reset passwords for any accounts accessed while the device was compromised, particularly those linked to financial services or sensitive data. Monitor financial statements and device behavior for signs of ongoing compromise. If malware is confirmed, consider a factory reset to ensure complete removal of threats.