skrill-login[.]top

This domain is assessed as high risk due to its association with a fake login credential phishing operation. Analysis indicates the infrastructure was intended to capture user authentication data through deceptive login interfaces. Although the domain has been taken offline, historical indicators remain relevant because similar infrastructure is often reactivated under new domains or reused in future campaigns.

Infrastructure analysis reveals that 17 of 95 security vendors flagged the domain as malicious. The domain resolved to IP address 185.138.88.209, located in the Netherlands under AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP. It was created on February 21, 2026. The observed page title was "FASTPANEL," and the SSL certificate status was identified as parking. The domain has been taken offline and appears on 5 security blocklists. These combined indicators support the high-risk assessment despite the current inactive status.

If credentials were entered on this domain before it was disabled, they should be considered potentially compromised. Passwords should be changed immediately on affected accounts and anywhere they were reused, and multi-factor authentication should be enabled where available. Security teams should block the domain and associated IP indicators, review authentication logs for unauthorized access attempts, monitor for credential misuse, and retain these indicators for incident response and threat hunting activities.