blue-skyfin[.]us

The domain blue-skyfin.us was a phishing site engaged in brand impersonation, specifically targeting Facebook users. It presented itself as a legitimate service under the name 'Blue Skyfin Bank' but was designed to deceive victims into disclosing login credentials or other sensitive information. No crypto drainer kit was associated with this campaign. The site is currently taken offline, but its prior activity poses an elevated risk to those who may have interacted with it.

Blue-skyfin.us was flagged by 1 of 95 security vendors on VirusTotal, including Netcraft, and appeared on 1 security blocklist (PhishDestroy). The domain was registered through OwnRegistrar, Inc. on April 28, 2025, and resolved to the IP address 163.61.188.89, hosted under AS153568 (NEW DHAKA HARDWARE) in the US. No SSL certificate was available for the domain, and its nameservers were listed as null vip1.cupisweb.com and vip2.cupisweb.com. The observed page title was 'Blue Skyfin Bank,' reinforcing its deceptive branding.

Individuals who visited blue-skyfin.us should immediately change any passwords entered on the site, particularly for Facebook or linked accounts. Enabling two-factor authentication (2FA) on all critical services is strongly recommended to prevent unauthorized access. Monitor financial and social media accounts for signs of fraud, such as unauthorized logins or transactions. Report the phishing domain to relevant platforms, including Google Safe Browsing, PhishTank, or local cybersecurity authorities, to aid in broader mitigation efforts.