skyren[.]io

The domain skyren.io was created on September 29, 2024 and is currently listed as offline. Its DNS resolves to the IP address 172.67.140.37, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain is hosted on Cloudflare’s network and uses the nameservers alla.ns.cloudflare.com and alan.ns.cloudflare.com. No SSL certificate is presented for the site, indicating that HTTPS is not configured. The only visible page title retrieved from the site is "Bot Verification," suggesting a verification checkpoint rather than a legitimate service page.

Skyren.io appears on one security blocklist and has been blocked by the PhishDestroy service. It is referenced in a single AlienVault OTX pulse, providing additional corroboration of malicious use. VirusTotal scans show that three of ninety‑five security vendors flagged the domain, confirming that at least a subset of scanners consider it malicious. The registrar is listed as HOSTINGER operations, UAB.

While the domain’s current offline status may limit immediate threat exposure, the combination of blocklist presence, vendor detections, and OTX reporting indicates an elevated risk profile. Defenders should ensure that skyren.io is added to network deny lists, update web filtering rules to block the domain, and monitor for any re‑activation or related infrastructure. Continuous observation of Cloudflare‑hosted IPs associated with the domain is advised, as threat actors often shift hosting while retaining the same IP range. Given the lack of SSL and the generic "Bot Verification" page title, there is limited insight into the exact phishing payload, so further investigative probing should be reserved for controlled environments.