skinhtuse[.]com

This domain, skinhtuse.com, is flagged as a generic phishing threat designed to impersonate legitimate login portals. Analysis indicates no specific brand association, but the infrastructure aligns with credential harvesting campaigns. The domain lacks ties to known cryptocurrency drainer kits or advanced phishing frameworks, suggesting a simpler, broad-spectrum approach to capturing user credentials. No direct evidence of payload delivery or post-exploitation activity has been observed in available telemetry. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to the IP address 188.114.97.3, which has been linked to other low-reputation domains. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. Google Safe Browsing (GSB) status is not explicitly provided, but the domain's presence in a single threat intelligence pulse on AlienVault OTX further corroborates its malicious classification. The Gridinsoft trust score of 0/100 underscores its high-risk nature. As of the latest assessment, skinhtuse.com has been taken offline, likely due to hosting provider intervention or registrar enforcement actions. Despite its current inactive status, residual risk persists due to the potential for re-registration or migration to alternative infrastructure. Organizations are advised to block the domain and its associated IP (188.114.97.3) at the network perimeter. Endpoint protection systems should be updated to include this domain in phishing and malicious URL databases. Users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the exposure window, particularly if multi-factor authentication was not enabled. Continuous monitoring for related domains registered through the same registrar or resolving to the same IP range is recommended.