youtubevanced[.]gg

This domain, youtubevanced.gg, is actively flagged as a high-risk phishing site targeting users seeking the discontinued YouTube Vanced application. Infrastructure analysis reveals the domain was registered on September 26, 2023, through Spaceship, Inc., and currently resolves to a Cloudflare IP (172.67.136.233) located in Canada. The site employs Cloudflare security services, including HSTS and HTTP/3, alongside Google Analytics and Cloudflare Browser Insights, which may be used to monitor visitor behavior or evade detection. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites. The page title, 'YouTube Vanced - Download YouTube Vanced APK,' explicitly suggests the distribution of unauthorized or modified APK files, a known vector for malware or credential theft. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and holds a Gridinsoft trust score of 35/100, indicating significant risk. While four of ninety-one security vendors on VirusTotal flagged the domain, this partial detection rate does not confirm safety or maliciousness but aligns with the broader pattern of abuse. Defenders should treat this domain as an active threat, particularly for users attempting to download unofficial Android applications. The use of Cloudflare nameservers (courtney.ns.cloudflare.com, scott.ns.cloudflare.com) and the domain's continued HTTP 200 status suggest it remains operational. No evidence confirms the presence of a specific phishing kit or brand impersonation beyond the YouTube Vanced theme, but the distribution of APK files outside official channels is a well-documented attack method. Network-level blocking and user education are recommended to mitigate exposure.