skyslots[.]xyz

Analysis of skyslots.xyz, observed on July 24, 2026, indicates that the domain is currently offline but was previously identified as a crypto‑focused phishing site. The site presented the title “SKYSLOTS | Play at the best online casino based on Blockchain,” which aligns with the reported scam type of a crypto scam and the use of a Gambler Scam phishing kit. Registration data shows the domain was created on May 24, 2025 through NameCheap, Inc., and it is served by four nameservers (ns1‑ns4.nameserverhub.com). No TLS certificate was found, meaning the site operated over plain HTTP, a common characteristic of low‑trust fraudulent pages. The Global‑Data System IT Corporation AS42624 infrastructure in Switzerland hosts the domain at IP address 69.5.189.54.

Reputation checks reveal a Gridinsoft trust score of 1 / 100 and a single listing on a security blocklist. PhishDestroy has also blocked the domain, and VirusTotal recorded three detections out of ninety‑five scanners. The limited detection footprint suggests that the site may have been short‑lived or targeted a narrow audience. Uncertainties remain regarding the exact payload delivered to victims, as no forensic sample or URL path information is available.

Defenders should continue to monitor the IP range associated with AS42624 for related activity, enforce blocklists that include skyslots.xyz, and consider adding the domain to internal deny lists. Because the domain lacks SSL, any future re‑hosting attempts would be trivially identifiable by the absence of HTTPS. Network sensors should alert on outbound connections to 69.5.189.54 and on DNS queries for the domain, especially from users accessing cryptocurrency or gambling services. Ongoing vigilance is recommended to capture any resurgence of the kit or a re‑registration of the name.