vidmate-en[.]com

Analysis of vidmate-en.com shows an active infrastructure that aligns with a high‑risk brand‑impersonation campaign. The domain was registered on February 21, 2026 through Spaceship, Inc., and it resolves to the IP address 172.67.170.235, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution is handled by fish.ns.cloudflare.com and lars.ns.cloudflare.com, confirming the use of Cloudflare’s edge services and HTTP/3 support. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 designation, indicating a valid TLS configuration despite the malicious purpose. An HTTP request returns a 200 status code and the page title "VidMate for Android – Best Free Video & Music App," suggesting the site is masquerading as a legitimate download portal for the VidMate application. The threat classification is brand impersonation, with the target listed as "across," implying the campaign may aim at multiple brand recognitions rather than a single named entity.

Detection data shows that VirusTotal flagged the domain by one of ninety‑three security vendors, and the domain appears on three external blocklists. It is actively blocked by PhishDestroy, MetaMask, and SEAL, and receives a Gridinsoft trust score of 0 out of 100, reinforcing the assessment of malicious intent. No additional technical artefacts such as malicious payloads or credential‑stealing forms have been publicly disclosed, leaving the exact attack vector uncertain. However, the combination of a reputable TLS certificate, Cloudflare hosting, and a title that mimics a popular Android app creates a credible illusion for unsuspecting users.

Defenders should treat vidmate-en.com as hostile. Recommended mitigations include adding the domain to URL filtering and DNS blocklists, monitoring outbound traffic for connections to the associated Cloudflare IP range, and employing endpoint protection that can recognize the single vendor detection on VirusTotal.