app[.]siy[.]money

Analysis of app.siy.money indicates that the domain resolves to the IP address 104.21.25.183, which is hosted on the Cloudflare network. The domain is presently listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service, confirming that it is being used for phishing‑related activity. VirusTotal records show that the domain was submitted for scanning by 91 antivirus and URL‑reputation engines; none of the engines raised a detection at the time of analysis, but the absence of a detection does not constitute evidence of legitimacy. Public DNS queries for the domain return an error for the authoritative nameserver record, reported as NS_NOT_FOUND, indicating that the domain’s nameserver information is either misconfigured or deliberately concealed.

No additional telemetry such as Safe Browsing verdicts, Open Threat Exchange (OTX) tags, registrar details, SSL certificate data, HTTP response codes, trust‑score metrics, page‑title content, or direct evidence links were available in the current intelligence set. Given the limited visibility, the primary confidence stems from the blocklist entry and the active block by PhishDestroy, which together constitute concrete evidence that the domain is being leveraged for phishing attacks. The lack of detections on VirusTotal and the missing nameserver data create uncertainty regarding the current hosting configuration and whether the site is still serving malicious payloads.

Defenders should continue to enforce blocking of the domain at perimeter firewalls, proxy filters, and endpoint web‑filtering solutions. Monitoring of DNS queries for the domain and its resolved IP address is recommended to detect any resurgence of activity. Where possible, threat‑intelligence feeds should be updated to include the domain’s IP and any future sightings, and analysts should periodically re‑scan the domain with multi‑engine services to capture any changes in its behavior.