spotifymody[.]com

spotifymody.com was observed delivering a brand‑impersonation page titled “Spotify Premium MOD APK Download v9.0.78.228 (Unlocked)”. The domain was registered through NameCheap, Inc. on 27 November 2023 and resolves to the IP address 188.114.97.3, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. The authoritative name servers are bruce.ns.cloudflare.com and melissa.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. No TLS certificate was presented, meaning the site operated over plain HTTP only.

The Gridinsoft trust score for the domain is 0 / 100, reflecting a complete lack of trust. VirusTotal analysis shows that eight of ninety‑five scanned security vendors flagged the domain, suggesting a modest level of detection across the ecosystem. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. As of the reporting date the site is listed as taken offline, which limits immediate exposure but does not remove the underlying infrastructure.

The elevated risk rating assigned by internal assessment aligns with the observed indicators of compromise. Defenders should continue to monitor the associated IP address and Cloudflare name server pair for re‑use, enforce outbound filtering for HTTP traffic to the domain, and add the IP and domain to local blocklists. Given the lack of TLS and the low trust score, any residual connections should be terminated. Further investigation is recommended to determine whether the hosting provider or Cloudflare account has been leveraged for additional malicious domains, and to verify whether the eight vendor detections correspond to specific payloads or merely URL‑based heuristics.