App store, via being led through affiliate links to the data source, or via exploits in default software. You can peddle malware through the official play stor

App store, via being led through affiliate links to the data source, or via exploits in default software. You can peddle malware through the official play store for a while until you get caught -- at which point, you rename the application, register a new dev account, and keep going. I don't know where the servers are physically located, nor does it matter.