governance-skyecosystem[.]xyz

Analysis of governance-skyecosystem.xyz indicates that the domain was registered on 23 February 2026 through Dynadot LLC and is currently pointing to Cloudflare’s network (AS13335) with the IP address 172.67.139.30. The authoritative name servers aldo.ns.cloudflare.com and arya.ns.cloudflare.com confirm that the site is fully behind Cloudflare’s edge, employing HTTP/3 and a Let’s Encrypt E7 certificate, which provides TLS encryption but does not imply legitimacy. A HTTP 504 Gateway timeout response was observed, and the page title returned “governance-skyecosystem.xyz | 504: Gateway time‑out”, suggesting the service is unavailable at the time of testing.

VirusTotal scans show five of ninety‑three security vendors flagging the domain, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have listed it as malicious, reinforcing the suspicion of phishing activity. The domain appears on three security blocklists, indicating that at least a subset of the security community has taken protective action. The current offline status may be the result of takedown efforts or the operators disabling the site.

While the exact phishing payload or targeted brand is not disclosed in the available data, the combination of recent registration, Cloudflare‑hosted infrastructure, a valid TLS certificate, and multiple vendor detections aligns with patterns commonly observed in credential‑stealing campaigns. Defenders should continue to block the domain at network perimeter, update DNS filtering rules, monitor for any resurgence of the IP address or associated Cloudflare sub‑domains, and consider sharing the indicator set with threat‑intel sharing platforms to aid collective defense. Ongoing observation is recommended to detect potential re‑use of the infrastructure for future malicious campaigns.