linkskybet138[.]shop

The domain linkskybet138.shop was registered through NameCheap, Inc. and is currently taken offline, but historical evidence indicates a coordinated brand impersonation campaign targeting Facebook users. The site resolved to the Cloudflare IP address 172.67.185.230, located in the United States and announced under ASN 13335 (Cloudflare, Inc.). DNS resolution was provided by the Cloudflare nameservers and the HTTPS service was delivered with a Google Trust Services / WE1 certificate, confirming standard TLS provisioning despite the malicious intent. Technical fingerprints show a PHP backend paired with Bootstrap, AMP, LiveChat, jQuery, and external libraries from cdnjs, all delivered behind Cloudflare’s edge infrastructure.

The page title returned by the server was "Access Denied 2," which does not reveal the phishing payload but confirms that the site was reachable before being shut down. Security scoring systems rate the domain at 0/100 on the Gridinsoft trust metric, indicating a lack of benign reputation. VirusTotal analysis recorded detections from seven of ninety‑three scanning engines, reinforcing the malicious classification. The domain appears on one security blocklist and has been flagged by PhishDestroy, while AlienVault OTX lists it in a single threat pulse, demonstrating limited but concrete community awareness.

Defenders should continue to block the domain at perimeter firewalls and proxy filters, add the associated IP address and Cloudflare nameservers to deny lists where feasible, and monitor for new registrations that reuse the "linkskybet138" pattern or similar branding cues. Because the infrastructure relies on shared Cloudflare services, future iterations may employ different subdomains or IPs while preserving the same underlying kit; threat‑intel feeds should be updated to include the observed technology stack and the specific page title to aid rapid correlation.