app[.]skh[.]money

Analysis of app.skh.money as of August 05, 2026 indicates the domain remains active and is currently listed on a single security blocklist. The domain is also flagged by PhishDestroy, confirming its use in phishing operations. DNS resolution points to the IPv4 address 188.114.97.3; the authoritative name servers could not be retrieved (NS_NOT_FOUND), which limits further host‑based attribution.

The domain was submitted to VirusTotal where 91 antivirus and URL‑reputation engines examined the site; none reported a detection, but the absence of a detection does not constitute evidence of benign behavior. The lack of additional blocklist entries, absence of public SSL certificate details, and missing HTTP response data leave the broader threat surface ambiguous. Infrastructure analysis shows the hosting IP is part of a network often leveraged for short‑lived malicious sites, but without ASN or geolocation data the risk cannot be precisely quantified.

Defenders should continue to block traffic to app.skh.money at perimeter devices, monitor DNS queries for resolution to 188.114.97.3, and incorporate the domain into internal threat‑intel feeds. Ongoing observation is recommended to capture any future changes in detection status, blocklist presence, or hosting characteristics.