picsartmod[.]pro

This domain, picsartmod.pro, is actively distributing a counterfeit PicsArt MOD APK under the guise of version 30.0.3 with premium features unlocked. Analysis confirms this as a brand impersonation phishing campaign targeting users seeking unauthorized access to proprietary software. The domain remains operational and unmitigated as of the latest verification. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.21.85.99 and is registered through Dynadot Inc, with a creation date of July 31, 2024. Security telemetry shows 11 of 95 VirusTotal vendors flagging the domain as malicious, while it appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a legitimate but frequently abused certificate authority in phishing operations. Additional detection sources include PhishDestroy, MetaMask, and SEAL, indicating cross-sector recognition of the threat. Current risk assessment categorizes this domain as high-severity due to its active distribution of modified APK files, which may contain malicious payloads such as spyware, adware, or cryptocurrency drainers. Users are advised to avoid downloading software from this domain and to verify application sources exclusively through official app stores or vendor websites. Network administrators should implement DNS-based blocking for picsartmod.pro and its associated IP address. Endpoint protection solutions should be updated to detect and quarantine any files originating from this domain, particularly those masquerading as PicsArt MOD APKs.