app[.]sky[.]money-en[.]xyz

The domain app.sky.money-en.xyz has been identified as a high-risk phishing site as of August 04, 2026. Analysis shows that 12 out of 91 security vendors on VirusTotal have flagged this domain for malicious activity, indicating significant consensus among threat detection sources. The domain is currently active and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, with a creation date of July 02, 2026. Infrastructure checks reveal that it resolves to the IP address 104.21.51.61 and uses Cloudflare nameservers (david.ns.cloudflare.com and elinore.ns.cloudflare.com), which are commonly leveraged by threat actors to obscure hosting origins and enhance operational resilience.

This site is blocked by the PhishDestroy service and appears on at least one security blocklist, further corroborating its categorization as a phishing threat. There is no available information about the specific content or page title of the site, and the exact target or scam mechanism remains undetermined at this time. Given the domain’s active status and multiple threat intelligence flags, defenders should immediately block this domain within their networks and email gateways. Continuous monitoring for related domains and reassessment of downstream infrastructure linked to the resolved IP address is recommended.

No evidence links, detailed page analysis, or SSL information have been provided. The presence of multiple independent detections, a recent registration, and active blocking measures indicate ongoing risk and potential for user compromise. Further incident response actions may be warranted if any exposure to this domain is detected within internal systems.