subwaysurferapk[.]io

subwaysurferapk.io is an active high‑risk domain that masquerades as Apple. The site resolves to the IPv6 address 2a02:4780:6:1885:0:2e70:ff31:8, which is mapped to an Indonesian host under AS47583 (Hostinger International Limited). The domain was registered on 2024-10-30 through ENOM, INC., and uses a Let’s Encrypt R13 certificate. The web server returns HTTP 200 and hosts a WordPress installation backed by MySQL and PHP, with additional components such as Google Sign-in, LiteSpeed, Lightbox and jQuery. The page title observed is "Subway Surfers Mod APK v3.44.0 Premium Unlimited money 100% Working", indicating a mobile‑app promotion unrelated to Apple, suggesting a deceptive lure. The domain is listed on a single security blocklist, has a Gridinsoft trust score of 0/100, and one of 95 VirusTotal scanners flagged it as malicious. Nameservers point to dns-parking.com, a typical parking service. While the exact malicious payload is not yet disclosed, the combination of a low trust score, presence on a blocklist, and the tech_support scam classification warrants immediate defensive action. Organizations should add subwaysurferapk.io to URL filtering and firewall deny lists, monitor outbound connections to its IPv6 address, and enforce email and web gateway policies that block any content referencing the observed page title or the Apple brand from this host. Continuous threat intel monitoring is recommended to detect any evolution of the payload or additional indicators.