spotify-app[.]com

Analysis indicates that spotify-app.com was registered on August 07, 2025 through Dynadot LLC. The domain resolves to 188.114.96.3, which belongs to Cloudflare (AS13335) and is geolocated in the United States. The authoritative nameservers are harley.ns.cloudflare.com and tiffany.ns.cloudflare.com, both Cloudflare‑operated, suggesting the site leveraged Cloudflare’s CDN and protection services. The site presented a page titled “Spotify Premium APK Download Latest v9.1.2.1253 For Android 2025”, which directly references the Spotify brand and advertises a malicious Android application, confirming a brand‑impersonation intent. No TLS certificate was observed, meaning the site was delivered over plain HTTP, which reduces the appearance of legitimacy.

Security telemetry shows the domain is listed on one known blocklist and was flagged by PhishDestroy. VirusTotal recorded 14 detections out of 95 scanned engines, indicating a moderate level of malicious classification by antivirus and URL scanners. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the conclusion that the host is unsafe. The domain is currently offline, which may be a temporary takedown or a deliberate evasion step.

Uncertainty remains around the full scope of the malicious payload, the hosting environment beyond Cloudflare, and whether additional infrastructure such as command‑and‑control servers is associated with the same IP address. Defenders should continue to block the domain at perimeter defenses, update URL filtering and DNS sinkhole rules, and monitor for any resurgence of the same host name or IP address. Because the domain uses Cloudflare, any future re‑registration could inherit the same infrastructure, so threat‑intel feeds should be queried for new occurrences of the same nameservers or IP. Incident response teams should also be aware of potential malicious APK distribution campaigns targeting Android users, and advise users to only obtain applications from official app stores.