skywin[.]cc

PhishDestroy identifies skywin.cc as an elevated-risk domain hosting a generic phishing scheme impersonating an investment or trading portal. The site leverages social engineering tactics to trick visitors into submitting sensitive credentials or cryptocurrency deposits under the false promise of high returns. No known drainer kit payload was observed in automated analysis at this time, but the domain is actively used in lure campaigns targeting finance professionals and retail investors. This domain resolves to IP 188.114.96.3 and is flagged by 4 out of 95 VirusTotal security vendors. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on February 23, 2026, just days ago. The SSL certificate is issued by Let’s Encrypt, suggesting an attempt to appear legitimate. As of the last check, it does not appear on Google Safe Browsing (GSB) blocklists, though third-party blocklist aggregators may flag it intermittently. Skywin.cc currently remains active and unresolved. Immediate user action is to block access at the network and endpoint levels using the IP and domain hash. Organizations should add skywin.cc to deny lists and monitor outbound connections. While initial VT detection is low (4/95), the domain’s fresh registration and low detection ratio increase the risk of rapid escalation. Remaining risk is elevated due to active use and lack of widespread blocklisting.