spotymod[.]org

This domain, spotymod.org, was registered on 16 July 2025 through Spaceship, Inc. and is currently taken offline. The authoritative name servers are joaquin.ns.cloudflare.com and naomi.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The domain resolves to the IPv6 address 2a06:98c1:3120::3, which belongs to AS13335 Cloudflare, Inc., located in the United States. No TLS certificate is presented, meaning HTTPS connections are not available.

The site’s page title, “SpotyMod: The Ultimate Spotify Premium Mod (All Platforms)”, suggests a brand‑impersonation campaign targeting the Spotify brand, though the brand target field lists “across”. Gridinsoft assigns a trust score of 1 out of 100, reflecting extreme suspicion. VirusTotal reports that nine of ninety‑five scanning engines flagged the domain, and it appears on a single external blocklist. PhishDestroy has also listed the domain as blocked.

The combination of a low trust score, partial VirusTotal detections, and inclusion on a blocklist indicates malicious intent despite the current offline state. Defenders should continue to block the associated IPv6 address and the Cloudflare ASN, add spotymod.org to internal URL filtering policies, and monitor for any re‑registration or new subdomains using the same name servers. Because the site is no longer reachable, dynamic analysis is not possible; however, the existing indicators—registration details, name server configuration, IP ownership, lack of TLS, and detection counts—should be incorporated into threat‑intel feeds and SIEM correlation rules to catch future campaigns that reuse this infrastructure or adopt similar branding.