skyline-restore[.]tech

Analysis of skyline-restore.tech indicates that the domain was registered on February 21, 2026 through Web Commerce Communications Limited and is currently hosted behind Cloudflare’s network (AS13335). The authoritative nameservers are carioca.ns.cloudflare.com and clint.ns.cloudflare.com, and the domain resolves to IP address 172.67.166.137, which is geolocated to the United States. TLS termination is provided by a Google Trust Services certificate issued to the WE1 entity, confirming that HTTPS connections are encrypted but also confirming the use of a widely trusted certificate authority. The page title returned from the live endpoint before takedown was "Collab.Land | Command Center," suggesting the site may have been impersonating a collaboration platform, though the content has not been examined.

VirusTotal recorded seven detections out of ninety‑three scanned scanners, demonstrating that multiple security vendors have flagged the domain as malicious. The same domain appears on four independent blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—providing additional corroboration of its phishing intent. AlienVault OTX identified the domain in a single threat‑intelligence pulse, further linking it to known malicious activity. Technical profiling shows the site leveraged Cloudflare’s HTTP/3 support, a common choice for malicious operators seeking performance and anonymity.

No additional infrastructure details such as backend servers or content delivery patterns were disclosed. The domain’s current status is offline, which may be the result of takedown actions or voluntary removal by the operators. Given the observed indicators—registrar information, Cloudflare hosting, multi‑vendor detections, blocklist listings, and the deceptive page title—defenders should continue to block skyline-restore.tech at network perimeter devices, update URL filtering rules, and monitor for any re‑registration attempts.