app[.]wky[.]money

Analysis of the domain app.wky.money indicates that it is currently active and resolves to the IP address 188.114.96.3. The domain is listed on a single security blocklist, where it has been flagged by PhishDestroy. No additional blocklist entries are observed. The domain’s nameserver configuration returned NS_NOT_FOUND, suggesting that the authoritative name servers could not be retrieved at the time of inspection. VirusTotal records show that the domain was examined by 91 scanning engines, none of which reported a detection; the absence of a positive result does not constitute evidence of benign intent and should be weighed against other indicators.

No public Safe Browsing, Open Threat Exchange, registrar, SSL certificate, HTTP response code, trust‑score, page‑title, or supplementary evidence URLs have been disclosed for this domain, leaving those vectors unverified. Infrastructure analysis reveals a single‑host footprint at 188.114.96.3, which is hosted by a provider that frequently services transient or low‑reputation sites, increasing the likelihood of abuse. The lack of a visible SSL certificate or HTTPS enforcement further reduces confidence in the domain’s legitimacy. Because the domain is categorized as generic phishing, the most plausible malicious objective is the collection of credentials or financial information by masquerading as a legitimate service, although the exact target brand is not identified in the current data set.

Defenders should block network connections to 188.114.96.3 and add app.wky.money to internal URL filtering lists. Monitoring of DNS queries for the domain is recommended to detect any lateral propagation. Since the domain is already present on PhishDestroy’s blocklist, existing threat‑intel feeds that incorporate that list will likely provide automatic mitigation.