skywstrd.com: Credential Harvesting Campaign Active

PhishDestroy identifies skywstrd.com as an active credential harvesting domain engaged in phishing operations as of seed 5d4df4.

This domain, registered on May 15, 2026 through Ultahost, Inc., resolves to IP address 159.100.6.19 and utilizes a Let's Encrypt SSL certificate. VirusTotal analysis confirms detection by 1 out of 95 security vendors, indicating limited but concerning visibility within threat intelligence platforms. The domain's recent creation date combined with low blocklist presence suggests an emerging threat with potentially low historical detection rates.

Current status remains active, with no evidence of takedown measures. Technical indicators include the domain's use of a legitimate SSL certificate to establish false trust, and hosting on a shared IP address associated with multiple low-reputation domains. Given the elevation of risk factors—including the specific credential harvesting objective and active operational status—immediate defensive action is recommended. Organizations should block skywstrd.com at network and DNS levels, and users should avoid visiting the site entirely. Security teams are advised to monitor for any additional infrastructure connections and update threat intelligence feeds accordingly to prevent further exploitation.