skinheuse[.]com

This domain, skinheuse.com, is identified as a credential harvesting phishing site targeting users through generic social engineering tactics. Analysis indicates no direct association with a specific brand or drainer kit, suggesting a broad, opportunistic phishing campaign. The infrastructure appears designed to capture login credentials, payment details, or personally identifiable information (PII) through fraudulent web forms or cloned interfaces, though no specific payload or exfiltration endpoint has been confirmed in available telemetry. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently utilized for high-risk domains. It resolves to the IP address 172.67.196.42, a Cloudflare proxy endpoint that obscures the origin server. VirusTotal detection rates show 2 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. Google Safe Browsing (GSB) status remains unconfirmed in available data, and the domain was blocked by at least one enterprise-grade filtering system prior to takedown. As of the latest assessment, skinheuse.com has been taken offline, likely due to hosting provider or registrar intervention following abuse reports. However, residual risk persists due to the domain's recent creation date and the registrar's history of slow enforcement. Organizations are advised to monitor for related domains using the same IP or registrar, particularly those created in the same timeframe (late March 2026). Network defenders should update firewall rules to block traffic to 172.67.196.42 and conduct retrospective log analysis for connections to this domain. End-users who may have interacted with the site should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available.