skelosoft[.]com

Analysis indicates that skelosoft.com is an active phishing domain targeting users seeking unauthorized software modifications, commonly referred to as 'cheats.' The domain was registered on April 19, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 78.40.209.57, hosted under Qwins LTD in Finland. Nameservers are configured as fdomain.earth.orderbox-dns.com, fdomain.mars.orderbox-dns.com, and related subdomains, a pattern consistent with domains utilizing Orderbox DNS services. The page title, 'Skeelosoft - Undetected Free Cheats with 24/7 Support,' explicitly describes the site as offering unauthorized software tools, which aligns with phishing campaigns distributing malware or harvesting credentials under the guise of providing cheats. As of July 12, 2026, the domain remains active, returning an HTTP 200 status and utilizing a Let's Encrypt SSL certificate (serial number E8), which does not inherently indicate legitimacy due to its automated issuance process. Security vendor engagement with this domain is limited but present. Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist. AlienVault OTX includes the domain in a single threat intelligence pulse, suggesting prior detection in related campaigns. While only two of ninety-four security vendors on VirusTotal flag the domain, this does not preclude its malicious nature, as detection coverage for phishing domains often lags behind initial deployment. Defenders should treat skelosoft.com as high-risk infrastructure. The combination of recent registration, low trust scores, and explicit promotion of unauthorized software tools warrants immediate blocking at the network level. Further investigation into associated IP addresses and nameserver patterns may reveal additional related domains.