gtasamods[.]com

On 25 July 2026 analysts observed that the domain gtasamods.com is actively serving content under the page title “Download GTA San Andreas Mod Apk | Unlimited All”. The site resolves to the IPv4 address 188.114.96.3, which is assigned to AS13335 (Cloudflare, Inc.) and is geographically mapped to the United States. DNS resolution uses the Cloudflare authoritative name servers “maisie.ns.cloudflare.com” and “nash.ns.cloudflare.com”, and the HTTP response returns status code 200. The server negotiates HTTP/3, indicating modern transport support. The TLS certificate is issued by Google Trust Services under the “WE1” designation, providing a valid chain to a trusted root.

Registration information shows the domain was created on 21 February 2026 through the registrar Dynadot LLC. The domain is classified as a brand‑impersonation campaign targeting the “across” brand, as indicated in the supplied intelligence. Reputation checks reveal that PhishDestroy, MetaMask, and SEAL have added the domain to their blocklists, and three additional public blocklists also contain the address. VirusTotal analysis reports that four of ninety‑three scanning engines flagged the domain, confirming a modest level of malicious detection. Despite these indicators, the site remains reachable and continues to deliver HTTP 200 responses. Uncertainty remains regarding the exact malicious payload delivered, the extent of victim interaction, and whether any command‑and‑control infrastructure is associated with the host.

No detailed payload or dropper information was captured, and no public threat‑intel signatures beyond the blocklist entries have been published. Defenders should prioritize immediate DNS and URL filtering for gtasamods.com across enterprise perimeter defenses. Network monitoring should include alerts for outbound connections to 188.114.96.3 and any TLS handshakes using the Google Trust Services certificate observed on this host.