skybet[.]best

skybet.best is currently active and serves HTTP 200 responses with the page title “Just a moment…”. The site resolves to the IPv6 address 2606:4700:3035::ac43:9cc5, which is announced by AS13335 (Cloudflare, Inc.) and geolocated to the United States. Registration data shows the domain was created on 21 February 2026 through Dynadot LLC and uses the authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. The TLS certificate presented is identified as “WE1”. Gridinsoft assigns a trust score of 0/100, and two of ninety‑three VirusTotal scanners have flagged the domain, indicating a low‑level detection. The threat has been classified as a crypto‑gambling phishing operation and is listed on at least one security blocklist; PhishDestroy has already blocked it. Analysis indicates that the only publicly observable artifact is the generic “Just a moment…” title, which suggests a placeholder page often used to delay analysis or to host malicious payloads after a redirect. No additional content, login forms, or brand impersonation have been observed, leaving the exact phishing vector uncertain. The association with Cloudflare’s network is typical for fast‑flux or anonymized hosting, and the IPv6 address belongs to a shared infrastructure that may host multiple malicious sites. Defenders should add skybet.best and its IPv6 address to deny‑list or firewall rules, monitor DNS queries for the domain and its nameservers, and ensure that email and web filtering solutions flag any URLs pointing to this host. Continuous re‑scanning with multi‑engine services is recommended to capture any future changes in payload or hosting. Given the high risk rating, organizations handling cryptocurrency or gambling‑related accounts should treat any communications referencing skybet.best as malicious.