app[.]skky[.]money

The domain app.skky.money is currently observed as an active generic phishing infrastructure. DNS resolution points to the IPv4 address 188.114.96.3, and the domain’s authoritative name server information is unavailable (NS_NOT_FOUND). The site has been added to at least one external security blocklist and is actively blocked by the PhishDestroy feed, indicating that threat‑intelligence platforms have identified it as malicious.

A VirusTotal scan was performed by 91 independent scanning engines; at the time of analysis none of the engines reported a detection, though the absence of detections does not constitute evidence of benign behavior. The limited visibility into the hosting environment, registrar, SSL certificate details, and HTTP response characteristics prevents a full attribution of the underlying infrastructure. Consequently, analysts should treat the domain as hostile until further forensic data becomes available.

Defensive recommendations include immediate domain‑level blocking on perimeter firewalls and DNS filtering solutions, continuous monitoring of the IP address 188.114.96.3 for any new malicious activity, and periodic re‑scanning on multi‑engine platforms to capture any future detections. Organizations should also consider sharing any observed indicators of compromise with industry‑wide threat‑sharing groups to enhance collective awareness of this emerging phishing campaign.