spootifyapks[.]com

Analysis of spootifyapks.com as of July 24, 2026 indicates that the domain was registered through NameCheap, Inc. on January 12, 2025 and is presently taken offline. The site presented a page title reading “Spotify MOD APK v9.0.0.487 Download ( MOD, Unlocked / Ads‑Free) 2025”, which suggests a malicious distribution of modified application packages, yet the declared threat type is brand impersonation targeting the Amazon brand. VirusTotal records show that 11 of 95 scanning engines flagged the domain, reflecting a moderate level of detection across independent security products. The domain resolves to IP address 172.67.192.253, an address owned by Cloudflare, Inc. (AS13335) and located in the United States.

No SSL certificate was observed, leaving the HTTP connection unencrypted. The hosting infrastructure is identified by the authoritative nameservers aliza.ns.cloudflare.com and roan.ns.cloudflare.com. Reputation metrics are extremely low, with Gridinsoft assigning a trust score of 0 out of 100, and the domain appears on a single external blocklist, specifically PhishDestroy, which has already blocked it. The combination of a recent registration date, low trust rating, absence of TLS, and multiple vendor detections suggests deliberate malicious intent.

Because the site is currently offline, the exact content and any credential‑harvesting mechanisms cannot be verified, creating uncertainty around the full scope of the campaign. Defenders are advised to continue blocking the domain and its associated IP address at network perimeter devices, add the domain to internal URL filtering lists, and monitor for any future re‑registration or use of the same IP range. Continuous observation of Cloudflare‑hosted assets linked to the same nameservers is recommended, as threat actors often reuse such infrastructure for subsequent campaigns.