skyecrduno[.]com

This domain, skyecrduno.com, is flagged as a credential theft operation specifically targeting Skye Credit Union members. Analysis indicates the site masquerades as the legitimate financial institution, presenting a fraudulent login interface to capture user credentials. No cryptocurrency drainer infrastructure or payment redirection mechanisms were observed, distinguishing this as a pure credential harvesting campaign rather than a multi-stage financial fraud scheme. The impersonation extends to visual design elements, including logos, color schemes, and the page title 'Skyecredit Union | Official Website,' which closely mirrors the authentic institution's branding to deceive visitors. Infrastructure analysis reveals concrete technical indicators of malicious activity. The domain was registered on May 10, 2025, through GMO Internet, Inc., and resolves to the IP address 213.165.249.109. VirusTotal reports 1 out of 95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Detected technologies include Nginx and OpenResty, which are commonly used in both legitimate and malicious web infrastructure, though their presence here aligns with typical phishing server configurations. As of the latest assessment, skyecrduno.com has been taken offline, likely in response to detection and reporting. However, the elevated risk level persists due to the domain's recent creation, its presence on security blocklists, and the potential for the infrastructure to be reactivated under a different address. Users who may have interacted with the site are advised to immediately reset their credentials for Skye Credit Union and any other accounts where the same login details were reused. Financial institutions and security teams should monitor for related domains registered through the same registrar or resolving to the same IP range, as these may indicate further impersonation attempts. The low detection rate on VirusTotal suggests this campaign may have evaded broader scrutiny, underscoring the need for layered security controls, including real-time domain reputation checks and endpoint protection.