spotmodapk[.]com

Analysis of spotmodapk.com indicates a brand‑impersonation infrastructure targeting Google. The domain was registered on April 13 2025 through Spaceship, Inc. and currently resolves to 172.67.189.229, an address owned by Cloudflare (AS13335) located in the United States. DNS resolution uses the Cloudflare authoritative nameservers miki.ns.cloudflare.com and pete.ns.cloudflare.com, confirming that the site is fronted by Cloudflare’s CDN and WAF services. The TLS certificate presented is issued by Google Trust Services under the WE1 identifier, which may be intended to lend legitimacy to the site despite the underlying malicious purpose. The page title returned by the site reads “Spotify MOD APK Download Latest Version (Premium Free)”, suggesting an attempt to lure users seeking unauthorized modifications of the Spotify application.

Although the title references Spotify, the listed brand target is Google, indicating a possible dual‑brand impersonation strategy or misclassification in the intelligence feed. Reputation data show a Gridinsoft trust score of 0 / 100 and the domain appears on one security blocklist. PhishDestroy has actively blocked the domain, and VirusTotal reports 16 of 95 scanned security vendors flagging the domain as malicious. AlienVault OTX references the domain in 15 separate threat‑intel pulses, reinforcing its association with malicious activity.

The site’s current HTTP status is offline, but historical activity warrants continued vigilance. Defenders should add spotmodapk.com and its resolved IP 172.67.189.229 to deny‑list controls, monitor for new DNS records that may re‑activate the domain, and incorporate the observed SSL fingerprint into TLS inspection rules. Correlation with ongoing Google‑related phishing campaigns is recommended, as the domain’s apparent focus on Google credentials may be part of a broader impersonation campaign. Continuous feed updates from blocklists, OTX, and VT should be consulted for any re‑emergence.