gtasanandreas[.]info

The domain gtasanandreas.info was registered on February 21, 2026 through Name.com, Inc. and is hosted on an Amazon Web Services (AS16509) infrastructure that resolves to the IPv4 address 216.198.79.65, located in the United States. DNS resolution is delegated to ns1.vercel-dns.com and ns2.vercel-dns.com, indicating use of Vercel’s DNS service. No TLS certificate is presented, leaving the site accessible only over HTTP. The site’s page title, "GTA San Andreas MOD APK 2025 - Unlimited Money & All Features Unlocked | GTA San Andreas," suggests an offer of a modified Android application for the video game, and the listed scam type is an Account Takeover, implying that the infrastructure may have been used to harvest credentials for unauthorized access to user accounts.

The domain appears on three external security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple threat‑mitigation services have identified it as malicious. VirusTotal analysis reports that two of ninety‑three security vendors flagged the domain, providing additional independent confirmation of its malicious nature. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility of the site. Current status is offline, indicating that the hosting has been taken down or the site is otherwise inaccessible.

Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any resurgence of the same IP address or DNS records. Because the domain’s content has not been publicly captured, further forensic collection of HTTP responses, redirects, and any associated payloads would be valuable for attribution and for refining detection signatures. Continuous observation of the associated IP range and the Vercel DNS zones is recommended to catch any re‑use of the infrastructure for future brand‑impersonation campaigns.