app[.]zky[.]money

The domain app.zky.money is currently observed resolving to the IPv4 address 172.67.160.90. Network telemetry indicates that the host is listed on a single security blocklist, and the domain has been actively blocked by the PhishDestroy filtering service. VirusTotal records show that the domain was submitted for analysis and scanned by 91 independent antivirus and URL scanning vendors; none of the scanners have raised a detection at the time of review.

The absence of detections is explicitly noted as insufficient evidence of safety, and the domain remains classified as a generic phishing infrastructure under investigation. Nameserver information could not be retrieved, as the domain’s NS records are missing or obscured. No additional intelligence such as registrar details, SSL certificate data, HTTP response codes, Safe Browsing verdicts, OTX mentions, or page title information is presently available.

The cumulative evidence points to an active malicious payload delivery platform that is likely being used to host credential‑harvesting pages or other phishing content, although the exact target brand or lure has not been disclosed. Defenders should prioritize adding app.zky.money to network‑level deny lists, enforce DNS‑based blocking, and monitor traffic to the associated IP address 172.67.160.90 for anomalous patterns. Continuous re‑assessment is recommended, as the domain’s threat posture may evolve with further detection vendor updates or additional blocklist listings.