skyspace-income[.]xyz

skyspace-income.xyz is currently active and has been classified as a generic phishing site. The domain was registered through NameSilo, LLC on 25 June 2026 and resolves to the IPv4 address 5.182.208.206. Authoritative name servers ns1.zencorehost.com and ns2.zencorehost.com are in use. VirusTotal reports that two of ninety‑one scanning engines have flagged the domain, indicating that at least a small subset of security products recognize malicious behavior. The domain appears on one external blocklist and is listed as blocked by the PhishDestroy service, which suggests that at least one dedicated anti‑phishing feed is already distributing indicators for this host.

No additional public reputation services or safe‑browsing checks are mentioned in the available intelligence. The limited detection footprint implies that the site may be newly deployed or employing evasion techniques that keep it under the radar of many scanners. Defenders should add 5.182.208.206 to network‑level deny lists and enforce DNS filtering for skyspace-income.xyz. Because the registrar is NameSilo, LLC, investigators may consider contacting the registrar for abuse remediation. Monitoring of the two Zencorehost name servers for future changes is advisable, as alterations could point to new campaign infrastructure.

Given the active status, continuous telemetry collection—such as DNS query logs, proxy alerts, and endpoint telemetry—should be maintained to capture any attempted connections. Integration of the known indicator set (domain, IP, name servers) into SIEM correlation rules will help surface related activity. Organizations employing web‑filtering solutions should ensure the domain is explicitly blocked, and any existing email security gateways should treat messages containing this domain as high‑confidence phishing.