spotiffyapkpremium[.]com[.]mx

This domain, spotiffyapkpremium.com.mx, is actively engaged in credential theft through brand impersonation of Spotify Premium. Analysis of the page title, 'Spotify Premium APK v9.4.72.523 Descargar Gratis Full Mod,' indicates an attempt to deceive users into downloading a fraudulent application that likely harvests login credentials or installs malicious payloads. The domain mimics legitimate Spotify offerings, leveraging the promise of free premium access to lure victims into compromising their account security. Infrastructure analysis reveals the domain resolves to the IP address 172.67.209.168 and was registered on June 08, 2026, through an undisclosed registrar. Detection metrics show the domain is flagged by 5 out of 95 security vendors on VirusTotal, while its SSL certificate is issued by Google Trust Services (WE1). The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further corroborating its malicious intent. Google Safe Browsing (GSB) status remains unconfirmed but is likely marked as unsafe given the blocklist presence. As of the latest assessment, spotiffyapkpremium.com.mx remains active, posing a continued risk to users seeking unofficial Spotify APK downloads. Response actions by security entities have included blocklisting, but the domain persists in resolving and hosting malicious content. Users are advised to avoid interaction with the domain, verify official sources for software downloads, and employ endpoint protection to mitigate credential theft risks. The infrastructure's resilience suggests ongoing operational efforts by threat actors to maintain the campaign.