onstreamapks[.]net

This domain, onstreamapks.net, is actively distributing counterfeit Android application packages (APKs) under the guise of the OnStream brand, constituting a brand impersonation phishing threat. The site presents itself as an official source for OnStream APK version 1.2.0, targeting Android users with malicious software distribution. Current status confirms the domain remains operational and unmitigated. Analysis indicates the domain was registered on June 8, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, resolving to IP address 172.67.131.234. Security vendors on VirusTotal have flagged the domain, with 5 of 95 engines detecting malicious activity. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic observed in both legitimate and malicious infrastructure. Infrastructure analysis further reveals the domain appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a high-risk threat. The continued activity of onstreamapks.net poses a significant risk to end-users, particularly those seeking mobile applications outside official app stores. The domain’s infrastructure and registration patterns align with known phishing campaigns designed to distribute malware or facilitate credential harvesting. Organizations and individuals are advised to block the domain at the network level and implement DNS-based filtering to prevent access. End-users should be educated to verify application sources exclusively through official app stores or verified developer websites. Security teams are recommended to monitor for indicators of compromise, including the IP address 172.67.131.234 and associated SSL certificate thumbprints, and to report any observed interactions with the domain to relevant threat intelligence platforms.