skys[.]com[.]br

This domain, skys.com.br, is flagged as a credential harvesting phishing site targeting users through a fabricated brand identity labeled Sky's Burger. Analysis indicates the domain was designed to mimic a legitimate fast-food service, likely to harvest login credentials, payment details, or personal information from unsuspecting victims. No specific drainer kit signatures were identified in initial scans, though the site's structure aligns with common phishing page templates used for credential theft and financial fraud. Infrastructure analysis reveals the domain was registered on December 13, 2000, through HGBLOCK-10 (ASN: 19871), an offshore registrar often associated with high-risk domains. It resolves to IP address 192.185.217.252, hosted in the United States under AS19871 (Network Solutions, LLC). The domain is flagged by 11 out of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. It appears on two security blocklists, including PhishDestroy and PhishingDB, and uses a Let's Encrypt SSL certificate (R12) to create a false sense of legitimacy. Google Safe Browsing status was not explicitly provided, but the domain's presence on multiple blocklists suggests it was actively blocked by enterprise security tools. As of the latest scan, skys.com.br has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed for future phishing campaigns. Organizations should maintain blocklist entries for this domain and monitor its DNS resolution for signs of re-emergence. Users who may have interacted with the site are advised to reset credentials for any accounts accessed during the exposure window, particularly if reused across multiple platforms. Network administrators should review logs for connections to 192.185.217.252 and the domain itself to identify potential compromise indicators within their environments.