skinbaronn[.]at

skinbaronn.at is currently active and returns HTTP 302 redirects. The site presents the page title “Skinbaron — Official Resource”, indicating an attempt to masquerade as the legitimate Skinbaron service. The domain uses a Let’s Encrypt certificate (YR2) and resolves to IP 209.74.82.247, which is hosted by Namecheap Inc in Singapore. Threat intelligence sources have recorded the domain in two AlienVault OTX pulses and on three public blocklists. Six of ninety‑one VirusTotal scanners have flagged the host as malicious. The infrastructure has been blocked by PhishDestroy, MetaMask and the SEAL platform. The available data does not reveal the specific payload or credential‑stealing mechanism, nor does it disclose any associated command‑and‑control infrastructure. Analysts should continue to monitor the domain for changes, block the IP and domain at network perimeter, and update detection rules to include the observed HTTP 302 behavior and the Let’s Encrypt certificate fingerprint. Additional investigation is recommended to capture any submitted data and to determine if the site is part of a broader phishing campaign targeting Skinbaron users.