skyslots[.]us

Analysis performed on 24 July 2026 identifies the domain skyslots.us as an active component of a crypto‑focused gambling phishing campaign. The site was registered through NameCheap on 4 July 2025 and resolves to the IPv4 address 69.5.189.54, which belongs to AS42624 Global‑Data System IT Corporation in Switzerland. The domain is served by four nameservers (ns1.nameserverhub.com, ns2.nameserverhub.com, ns3.nameserverhub.com, ns4.nameserverhub.com). No TLS certificate is presented, indicating that the site operates over plain HTTP. The page title returned from the host reads “SKYSLOTS | Play at the best online casino based on Blockchain,” suggesting an attempt to lure victims with a blockchain‑based casino narrative.

The payload has been linked to the publicly available “Gambler Scam” phishing kit, and the site is classified as a crypto scam in the intelligence feed. Reputation services show a Gridinsoft trust score of 1 / 100 and eight of ninety‑five VirusTotal scanners flagged the domain, reflecting a high likelihood of malicious intent. The domain appears on one external blocklist and has been taken down by the PhishDestroy remediation network. It is currently listed as offline, which may be the result of takedown actions or the operator’s own shutdown.

Uncertainty remains regarding the current operational status of the underlying phishing infrastructure, as the domain is offline but the IP address is still allocated to a hosting provider. No SSL/TLS, no safe‑browsing verdict, and limited blocklist presence mean that defenders should continue to monitor the IP and associated nameservers for potential re‑use. Defensive recommendations include adding the domain and its IP to web‑gateway block lists, configuring DNS‑level deny rules for the nameservers, and increasing telemetry on traffic toward the AS42624 network.