skyscannersbr[.]com

PhishDestroy identifies skyscannersbr.com as an active brand impersonation campaign targeting Skyscanner users to deploy a crypto drainer. The domain resolves to IP 216.198.79.1 and leverages a recently issued Let’s Encrypt SSL certificate, suggesting an attempt to appear legitimate to unsuspecting visitors. Creation on March 08, 2026, and registration through Fewmoretaps OU d/b/a Trustname.com indicate a hasty setup designed to evade early detection, while current VirusTotal scanning shows 0/95 antivirus engines flagging the domain, highlighting its stealth and potential for rapid spread before takedown.

Technical indicators include the domain’s association with a newly created infrastructure and a low detection rate, which together elevate the risk profile. The domain’s recent registration date and hosting on a shared IP further support the likelihood of a short-lived but high-impact campaign aimed at capturing cryptocurrency wallet credentials or draining funds through fraudulent transactions. Given the absence of blocklist entries at this stage, the threat remains unmitigated and poses a direct risk to users who may mistake the domain for the official Skyscanner platform.

Users who visited skyscannersbr.com should immediately disconnect any crypto wallets or browser sessions, scan devices for malware using updated antivirus tools, and avoid re-engaging with the domain. Report the domain to your security team or via platforms like PhishDestroy, and consider revoking any permissions granted to suspicious domains. Stay vigilant for unexpected wallet prompts or unsolicited transaction requests, as these may indicate compromise.