skibhouse[.]com

This domain, skibhouse.com, is flagged as a credential harvesting phishing site targeting unsuspecting users through deceptive login portals. Analysis indicates no direct association with a specific brand or known phishing kit, though the infrastructure aligns with generic credential theft campaigns. The domain lacks legitimate business context, and its design suggests an intent to mimic authentication pages for data exfiltration purposes.

Technical indicators reveal critical red flags: the domain is detected by 3 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It resolves to the IP address 188.114.97.3, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026—an unusually future-dated creation timestamp that may indicate domain spoofing or typo-squatting tactics. AlienVault OTX lists the domain in one threat intelligence pulse, and it appears on a single security blocklist. Google Safe Browsing (GSB) does not currently flag the domain, though this may reflect a lag in detection rather than benign status.

As of the latest assessment, skibhouse.com has been taken offline, likely due to enforcement actions by security providers or hosting suspensions. The domain was blocked by PhishDestroy, mitigating immediate user exposure. However, residual risk persists due to the domain's recent registration pattern and potential for re-emergence under altered infrastructure. Organizations are advised to monitor for related domains, update blocklists proactively, and educate users on recognizing credential harvesting tactics. Network defenders should investigate logs for prior connections to 188.114.97.3 and correlate with other indicators from this campaign.