vanced.
vanced.com.co publishes a detailed guide that promotes downloading and installing ReVanced YouTube Magisk modules and modified YouTube APKs on rooted Android devices.
At a glance
Antivirus · registration · identity- 0 engines classified the URL as malicious and 1 as suspicious; 58 returned harmless, 33 returned undetected, and 0 returned no usable result.
- Operator identity: Claimed Only. Contact details are present but not independently verified
- Google Safe Browsing returned no listed threat categories for this address at scan time.
- The site presented a valid TLSv1.3 certificate at scan time.
- A page capture was analyzed and did not record a visual clone indicator.
Intelligence
The page at https://vanced.com.co/youtube-vanced-guide-for-content-creators/ presents itself as a content-creator workflow guide but immediately directs visitors toward ReVanced YouTube Magisk, a module that patches the stock YouTube app on rooted devices. The content walks through downloading version 20.14.43 from GitHub, installing it via Magisk, and enabling ad-blocking, background playback, and SponsorBlock without a Premium subscription. This pattern matches known distribution tactics that leverage the defunct YouTube Vanced name to push unauthorized software modifications.
Evidence Map
One or more reputation sources recorded a concern
Contact details are present but not independently verified
Only partial behavior evidence was available
No reliable registration history was saved
- 1Promotes and links to third-party modified YouTube APKs and Magisk modules that replace the official app
- 2Encourages system-level rooting and module installation on Android devices
- 3Uses branding of the discontinued YouTube Vanced project to appear legitimate
- 4No contact email, phone, or postal address provided
- 1Valid TLSv1.3 certificate presented at scan time
- 2Zero redirect hops and no visual clone indicators recorded
- 3Hosting IP had an abuse-confidence score of 0/100
Site purpose and visitor journey
The page title and description frame the content as a productivity guide for YouTube creators, yet the body quickly shifts to promoting ReVanced YouTube Magisk as the solution for ad-free viewing and background play. Step-by-step instructions tell visitors to verify root access, download a 170 MB ZIP, load it through the Magisk app, and reboot. The text repeatedly references the discontinued YouTube Vanced project to establish familiarity and legitimacy.
Observed claims and distribution mechanics
The guide lists multiple version numbers with update dates in 2025 and 2026, provides installation checklists, and compares ReVanced against alternatives such as NewPipe and LibreTube. It explicitly states that the module replaces the official YouTube app rather than running alongside it. External domains are referenced for downloads and trackers, though no direct malware sample was captured in the scan.
Branding and risk indicators
Professional-looking documentation style, high-risk keywords such as “rooted Android” and “Magisk,” and impersonation of the original YouTube Vanced project are all visible on the captured page. No contact email, phone number, or postal address appears anywhere on the site, leaving only three social links as the sole point of operator presence.
Technical signals at scan time
The domain served a valid TLSv1.3 certificate with no redirect hops. Zero antivirus engines flagged the URL as malicious, one marked it suspicious, and Google Safe Browsing returned no threat categories. The hosting IP showed an abuse-confidence score of 0/100. Despite these clean network signals, the page content itself promotes unauthorized software modification and rooting.
Website Preview
The site mimics the branding of a defunct project to distribute third-party YouTube modification tools, a common tactic for spreading malicious software under the guise of legitimate utility.
- 1Impersonation of the discontinued YouTube Vanced project to distribute potentially unauthorized software
- 2Use of high-risk keywords like 'Rooted Android' and 'Magisk' to entice users into modifying system-level software
- 3Promotes third-party bypass tools for YouTube, which are frequently used as vectors for malware delivery
- 4Professional-looking branding designed to mimic legitimate open-source project documentation
Web Research
Threat Detection
Antivirus results, browser warnings, isolated page observations, and the threat pattern identified in this report.
Antivirus engine results
Evidence behind this threat profile
- 1Promotes and links to third-party modified YouTube APKs and Magisk modules that replace the official app
- 2Encourages system-level rooting and module installation on Android devices
- 3Uses branding of the discontinued YouTube Vanced project to appear legitimate
- 4No contact email, phone, or postal address provided
2 of 21 categories showed signals
This profile separates the site's primary threat from other patterns supported by the saved page evidence, public research, and security findings.
- Page promotes ReVanced YouTube Magisk module and modified APKs for rooted Android
- Visual analysis explicitly flags impersonation of discontinued YouTube Vanced project to distribute unauthorized software
- High-risk keywords (rooted Android, Magisk) used to entice system modification
- Gridinsoft flagged the domain as suspicious
- Content focuses on distributing patched/modified versions of YouTube that bypass official restrictions
- Explicitly advertises ad-blocking, background play, and SponsorBlock without Premium subscription
- Provides step-by-step installation instructions for Magisk modules that replace the stock app
Technical Details
Identity, domain, infrastructure, and connection facts saved with this scan.
July 20, 2026 at 10:14 AM UTCIdentity
6 facts- Operator
- Claimed Only
- On-domain email
- Not observed
- Other email
- Not observed
- Phone
- Not observed
- Postal address
- Not observed
- Social profiles
- 3 links
Domain
8 facts- Domain age
- Unavailable
- Registered
- Unavailable
- Registrar
- Unavailable
- Expires
- Unavailable
- WHOIS updated
- Unavailable
- Registrant
- Unavailable
- Registration country
- Unavailable
- WHOIS privacy
- Unavailable
Infrastructure
14 facts- HTTPS
- Valid certificate
- TLS protocol
- TLSv1.3
- Certificate issuer
- Google Trust Services · WE1
- Certificate subject
- vanced.com.co
- Certificate valid from
- Jun 13, 2026
- Certificate valid to
- Sep 11, 2026
- Network address
- 172.67.166.124
- ASN
- Unavailable
- Hosting organization
- Cloudflare, Inc.
- Country
- US
- Server
- cloudflare
- Site platform
- WordPress
- IP reputation
- 0% confidence · 0 reports
- Tor exit node
- No
Connections
13 facts- Scan scope
- Specific page
- Destination host
- vanced.com.co
- Redirects
- 0
- Cross-domain redirect
- No
- Redirect status codes
- 200
- Lookalike characters
- Not observed
- Internationalized domain
- No
- Page response
- 200
- Observation coverage
- Unavailable
- Extracted links
- Unavailable
- Unique IPs contacted
- Unavailable
- Countries contacted
- Unavailable
- Referenced domains
- 10
What to do
Do not download or install any software from this site. The page provides detailed instructions for obtaining and installing unauthorized ReVanced YouTube Magisk modules that modify the official YouTube app on rooted devices.
If you downloaded or opened a file, disconnect the device if it behaves unexpectedly, run a full security scan, remove anything installed from the page, and change important passwords from a different trusted device.
Final Verdict
Why this verdict
The verdict is suspicious because the site uses the discontinued YouTube Vanced brand to distribute third-party modified YouTube APKs and Magisk modules that replace the official app, while encouraging system-level rooting and module installation.
Do not download or install any software from this site. The page provides detailed instructions for obtaining and installing unauthorized ReVanced YouTube Magisk modules that modify the official YouTube app on rooted devices.
Key evidence
- 1Promotes and links to third-party modified YouTube APKs and Magisk modules that replace the official app
- 2Encourages system-level rooting and module installation on Android devices
- 3Uses branding of the discontinued YouTube Vanced project to appear legitimate
Safety FAQ
Is vanced.com.co safe to use?+
The verdict is suspicious because the site uses the discontinued YouTube Vanced brand to distribute third-party modified YouTube APKs and Magisk modules that replace the official app, while encouraging system-level rooting and module installation.
What should I do about vanced.com.co?+
Do not download or install any software from this site. The page provides detailed instructions for obtaining and installing unauthorized ReVanced YouTube Magisk modules that modify the official YouTube app on rooted devices.
How old is vanced.com.co?+
A reliable public registration date was not available for vanced.com.co.
What if I already interacted with vanced.com.co?+
If you downloaded or opened a file, disconnect the device if it behaves unexpectedly, run a full security scan, remove anything installed from the page, and change important passwords from a different trusted device.
When was this report updated?+
This report reflects the scan completed July 20, 2026 at 10:14 AM UTC.
User reviews & comments(0)
Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.