skykkeo[.]xyz

This domain, skykkeo.xyz, is flagged as a high-risk phishing site specializing in crypto wallet credential harvesting. Analysis indicates the infrastructure is designed to mimic legitimate wallet interfaces, likely targeting users of decentralized finance platforms. No specific brand impersonation or drainer kit signatures have been confirmed at this time, though the domain structure and hosting patterns align with known phishing campaigns in the cryptocurrency space. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 13, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with privacy-protected malicious registrations. It resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), a common proxy service used to obfuscate the true origin of phishing sites. The domain appears on one security blocklist, and VirusTotal reports a detection score of 1/95 security vendors. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, provides no inherent trust for the domain's content. Google Safe Browsing (GSB) currently does not list this domain, though this may reflect a lag in detection rather than a clean status. As of the latest assessment, skykkeo.xyz remains active and unresolved, posing an ongoing threat to users. The domain's Cloudflare proxy complicates takedown efforts, and its recent registration suggests it may evade detection for an extended period. Users are advised to block the domain at the network level and avoid interacting with any content hosted on it. Organizations should monitor for connections to 188.114.97.3 and the AS13335 network range, as these may indicate compromised endpoints or successful phishing attempts. Given the domain's low detection rate, manual verification of wallet addresses and transaction requests is strongly recommended for users in the cryptocurrency ecosystem.