skyscannerb[.]com

This domain, skyscannerb.com, is actively engaged in a credential theft campaign designed to harvest user login credentials by impersonating a legitimate travel booking service. Analysis of the page structure and metadata reveals a focus on replicating the appearance of a well-known travel comparison platform, likely to deceive users into entering sensitive account information. The page title 'Deployment Unavailable' suggests an attempt to mimic a temporary service disruption, a common tactic to lower user suspicion while capturing input data. Infrastructure analysis reveals multiple indicators of malicious activity. The domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with low-reputation domains. It resolves to the IP address 216.198.79.1 and is currently flagged by 3 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist, further corroborating its malicious intent. Detection of technologies such as Vercel and HSTS indicates an attempt to present a legitimate facade, though these are often exploited to lend credibility to phishing infrastructure. Users who have visited skyscannerb.com or entered credentials on this site should take immediate remediation steps. First, terminate any active sessions and disconnect from the network to prevent potential data exfiltration. Second, change passwords for any accounts accessed or entered on the site, prioritizing credentials associated with financial or email services. Third, monitor accounts for unauthorized activity, including login attempts or transactions. If financial data was exposed, contact relevant institutions to report potential fraud. Finally, scan local devices for malware to ensure no secondary infections were introduced during the interaction.