skr-season[.]app

The domain skr-season.app was registered on 2026-03-26 by NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently hosted behind Cloudflare infrastructure (IP 188.114.96.3, located in Canada). The TLS certificate is issued by Google Trust Services under the WE1 CA, indicating standard HTTPS termination. DNS resolution uses the Cloudflare‑provided authoritative nameservers cullen.ns.cloudflare.com and melany.ns.cloudflare.com. HTTP requests return a 403 status and the sole observed page title is “Just a moment…”, suggesting a possible interstitial or challenge page rather than a visible phishing landing page. The domain appears in one AlienVault OTX pulse and is listed on a single external blocklist; PhishDestroy has already flagged it, and VirusTotal reports detections from 12 of 94 scanned scanners. Gridinsoft assigns a trust score of 0/100. These indicators collectively classify the domain as a high‑risk generic phishing vector. Uncertainty remains regarding the exact payload or credential‑capture mechanism because no page content beyond the title has been captured. Defenders should treat any traffic to skr-season.app as malicious. Recommended actions include adding the domain and its resolved IP address to network‑level deny lists, enforcing URL filtering policies that block the host, and monitoring DNS query logs for attempted resolutions. Continuous threat‑intel feeds should be consulted for any emerging indicators, and incident response playbooks should be prepared to contain potential credential‑theft attempts should the site become active.