app[.]xky[.]money

Analysis of the domain app.xky.money indicates that it remains active as of the report date, August 05, 2026. The domain resolves to the IP address 188.114.96.3, and its authoritative nameserver information could not be retrieved (NS_NOT_FOUND). The infrastructure has been listed on one public security blocklist and is explicitly blocked by the PhishDestroy service, suggesting that defensive feeds have identified it as malicious.

VirusTotal records show that the domain was submitted for scanning and examined by 91 antivirus or URL‑reputation vendors; none of the vendors flagged the domain at the time of analysis, though the lack of detections does not constitute a safety guarantee. No additional intelligence such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, OTX references, or page title metadata is currently available, leaving the exact content and the targeted brand or credential collection method unverified.

Given the active status, the presence on a blocklist, and the observed IP mapping, security teams should consider adding app.xky.money to deny lists at the DNS, proxy, and endpoint layers, monitor for any outbound connections to the associated IP, and continue to watch for updates in threat intelligence feeds that may reveal further attributes such as hosting provider or malicious payloads. Ongoing observation is recommended to capture any changes in detection status or additional indicators of compromise.