skrilla[.]sbs

This domain is flagged as a high-risk crypto drainer phishing site designed to siphon cryptocurrency assets from victims. Analysis indicates the infrastructure is specifically engineered to mimic legitimate exchange platforms, tricking users into authorizing malicious transactions that result in irreversible fund loss. The threat type aligns with observed patterns of wallet-draining attacks, where victims are lured into connecting their wallets to fraudulent interfaces under the guise of token swaps or airdrops. Infrastructure analysis reveals the domain skrilla.sbs was registered on February 21, 2026, through Global Domain Group LLC, a registrar frequently associated with phishing operations. The domain resolves to IP address 104.21.7.79, hosted on AS13335 (Cloudflare, Inc.), a network commonly leveraged to obscure malicious infrastructure. At the time of assessment, the domain lacked an SSL certificate, further reducing its legitimacy. Detection metrics confirm the domain appears on three security blocklists, while VirusTotal reports 12 out of 95 security vendors flagging it as malicious. The page title, 'Exchange,' reinforces the impersonation of legitimate cryptocurrency platforms, a hallmark of crypto drainer campaigns. Mitigation requires immediate action from both end users and network defenders. Users who interacted with this domain should revoke all connected wallet authorizations via blockchain explorers or wallet interfaces, as lingering permissions may enable continued asset theft. Network-level protections should include DNS filtering to block resolution of skrilla.sbs and its associated IP. Organizations managing cryptocurrency infrastructure are advised to monitor for unauthorized transaction requests originating from this domain or its IP. Given the irreversible nature of blockchain transactions, proactive revocation of permissions is critical to preventing further asset loss.