# PhishDestroy threat dossier — lis-skin.pro ================================================================ Fetched: 2026-06-28 23:31:48 UTC Canonical: https://phishdestroy.io/domain/lis-skin.pro/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 45/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 85.122.114.138 (MD, Chisinau) ASN: ASAS200019 AlexHost ALEXHOST SRL, MD Hosting org: AS200019 ALEXHOST SRL Registrar: NameCheap, Inc. Nameservers: dns1.registrar-servers.com, dns2.registrar-servers.com Registered: 2026-04-23 Expires: 2027-04-23 Page title: Лис Скинс — продажа скинов КС и Дота с быстрыми выплатами HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-09-20 Status: INVALID chain Fingerprint: aecde4df20d7624a2ada2caf69feb7793b90cd20377458363de4c93d8b111670 Subject Alternative Names (related infrastructure — often same operator): - www.lis-skin.pro ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-23 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-27 20:17:56 UTC (by PhishDestroy tracker) First reported: 2026-06-27 18:19:16 UTC (abuse notice filed) Last verified: 2026-06-29 00:20:41 UTC Neutralised: 2026-06-28 00:01:28 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f0a4c-c0dd-73dc-bcbf-1d9bc94bc111/ URLQuery: https://urlquery.net/report/08d89d43-e521-4d1f-90e7-1dd9a12cd092 Wayback Machine: https://web.archive.org/web/*/lis-skin.pro crt.sh CT logs: https://crt.sh/?q=%25.lis-skin.pro Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=lis-skin.pro AlienVault OTX: https://otx.alienvault.com/indicator/domain/lis-skin.pro URLhaus: https://urlhaus.abuse.ch/host/lis-skin.pro/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-27 20:25:35 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain is flagged for hosting a credential harvesting phishing operation targeting users through deceptive login interfaces. Visitors may encounter fake authentication prompts designed to capture usernames, passwords, and other sensitive credentials, which are then transmitted to attacker-controlled infrastructure for unauthorized access or financial fraud. The site mimics legitimate services, increasing the likelihood of successful compromise for unsuspecting users. Analysis indicates the domain was registered on April 23, 2026, through NameCheap, Inc., and currently resolves to the IP address 85.122.114.138. Despite its recent creation, the domain has not yet been flagged by any of the 95 security vendors on VirusTotal, suggesting either evasion techniques or a lack of widespread detection. The SSL certificate is issued by Let's Encrypt, providing a false sense of security to visitors while the underlying content remains malicious. If you have visited lis-skin.pro or entered credentials on the site, immediate action is required. Disconnect the affected device from the network to prevent further data exfiltration. Reset all passwords associated with the compromised account, prioritizing email, financial, and administrative credentials. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions, and report any anomalies to the respective service providers. Additionally, scan the device for malware using updated security tools to detect potential secondary infections or persistence mechanisms. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260627-D0CF49 Favicon MD5: ca70637631e5ae745158d020a0fad3d0 TLS cert SHA-256: aecde4df20d7624a2ada2caf69feb7793b90cd20377458363de4c93d8b111670 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/lis-skin.pro/ JSON API: https://api.destroy.tools/v1/check?domain=lis-skin.pro Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 172,158 domains (14,573 alive under monitoring, 157,073 confirmed takedowns/dead). Site: https://phishdestroy.io