app[.]skym[.]money

app.skym.money is currently flagged as a generic phishing infrastructure under investigation. The domain resolves to the IP address 172.67.212.69 and is hosted on a CDN‑associated range; no autonomous system or geographic attribution is provided in the available data. Nameserver records could not be retrieved (NS_NOT_FOUND), which may indicate deliberate obfuscation or a misconfiguration. The domain has been added to one security blocklist and is listed as blocked by the PhishDestroy sinkhole, suggesting that at least one sinkhole operator has observed malicious traffic originating from the host. VirusTotal reports that the domain was examined by 91 scanning engines, none of which raised a detection at the time of analysis.

No detections should be interpreted as evidence of benign intent; the absence of a signal simply reflects the current coverage of the scanning engines. No Safe Browsing, OTX, or other reputation feeds have indexed the domain, and there is no publicly available registrar, creation date, or SSL certificate information. HTTP responses, page titles, and content fingerprints have not been captured, leaving the exact phishing payload unknown. Uncertainty remains around the specific campaign vectors, targeted brands, and victim interaction patterns because the site content has not been harvested. The lack of visible TLS metadata and the inability to resolve authoritative nameservers hinder attribution and threat‑intel correlation.

Defenders should treat the domain as a probable phishing vector until further evidence is obtained. Recommended actions include adding the domain to outbound web‑filter deny lists, monitoring DNS queries for the resolved IP, and enabling DNS‑sinkhole or proxy logging to capture any attempted connections. Continuous re‑scanning with VirusTotal or similar multi‑engine platforms is advised, as future detections may appear.