zwarteapk[.]com

Analysis of zwarteapk.com indicates a confirmed fraudulent domain targeting users seeking unauthorized APK inspection services, as suggested by its page title 'Zwarte Apk Keuring - Zwarte Apk Keuring.' The domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site is hosted behind Cloudflare (IP 104.21.14.130, AS13335), leveraging Cloudflare Browser Insights and HTTP/3 for performance and anonymity. Nameservers (angelina.ns.cloudflare.com, norm.ns.cloudflare.com) further confirm Cloudflare’s infrastructure, which is commonly exploited to obscure malicious origins. The domain holds a Gridinsoft trust score of 0/100 and is currently flagged by one security blocklist (PhishDestroy), though it remains undetected by vendor scans as of the latest assessment. This absence of detections does not confirm safety; rather, it reflects the domain’s recent registration and potential evasion of automated detection systems. The SSL certificate, issued by Google Trust Services (WE1), provides encryption but does not validate legitimacy, as certificates are routinely issued to malicious domains. Defenders should treat this domain as active and high-risk. The page title suggests a focus on APK-related fraud, though the exact nature of the scam—whether credential harvesting, malware distribution, or social engineering—remains unconfirmed due to lack of deeper content analysis. Network-level blocking is recommended, particularly for organizations handling mobile security or APK-related workflows. Monitoring for related domains registered through the same registrar or hosted on similar Cloudflare IPs (e.g., 104.21.0.0/16) may help identify associated threats. Given the domain’s recent creation and low detection rate, continued vigilance is advised.