skycannerbr[.]com

PhishDestroy identifies skycannerbr.com as an active phishing domain masquerading as a legitimate flight and travel booking service, likely targeting users seeking cheap flights with fraudulent payment collection. This domain was flagged as a generic phishing lure and is currently under investigation with an active status. VirusTotal analysis shows zero detections from 95 security vendors, indicating low detection coverage despite clear malicious intent. The domain skycannerbr.com was registered on March 8, 2026—only days ago—through Fewmoretaps OU operating under the alias Trustname.com, a registrar known to offer privacy protection services that can obscure true ownership. The infrastructure resolves to IP address 216.198.79.1 and is secured with a Let’s Encrypt SSL certificate, which may lend false legitimacy to unsuspecting visitors. Notably, this domain has not yet been widely listed on major threat intelligence blocklists due to its recent creation, creating a window of opportunity for threat actors. Users who visited skycannerbr.com should immediately cease any interaction with the site, avoid entering personal or payment information, and scan their devices for potential compromise. If credentials or financial data were input, reset account passwords, monitor bank statements for fraudulent charges, and report unauthorized transactions to your financial institution. Organizations are advised to block the domain and IP at the network perimeter and conduct endpoint scans to detect any associated malware or browser-based compromise. Given the low detection rate, this threat may persist undetected—prompt action is critical to prevent credential harvesting or financial loss.