app[.]aky[.]money

Analysis of app.aky.money conducted on 2026-08-05 indicates that the domain is currently active and resolves to the IPv4 address 104.21.30.167. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy service, confirming its classification as a phishing-related resource. VirusTotal records show that the domain was scanned by 91 antivirus and URL-reputation vendors; at the time of review none of the vendors reported a detection. While the absence of detections does not constitute evidence of benign behavior, it demonstrates that the domain has not yet triggered automated signatures in those engines.

The domain’s authoritative name server information could not be retrieved (NS_NOT_FOUND), which may indicate a misconfiguration or an attempt to obscure hosting details. The IP address 104.21.30.167 is associated with a content delivery network that frequently hosts legitimate traffic, which can be leveraged by malicious actors to blend in with normal web services. No additional metadata such as registrar, SSL certificate details, HTTP response codes, Safe Browsing status, or page title were available for analysis. Given the confirmed blocklist entry, the active DNS resolution, and the lack of public reputation, defenders should treat app.aky.money as a high-confidence phishing indicator.

Recommended mitigation steps include adding the domain to network and endpoint deny lists, monitoring DNS query logs for any lookups, and employing URL filtering solutions that reference the PhishDestroy blocklist. Continuous re-evaluation is advised, as further scans or community reports may surface additional detections. Organizations should share any observed activity with relevant information‑sharing groups to improve collective detection.