skirbox[.]com

This domain, skirbox.com, is identified as a phishing site targeting users seeking digital goods, as indicated by its Russian-language page title "Лучшие цифровые предметы только у нас!" (translation: "The best digital items only with us!"). Analysis suggests the site likely impersonates legitimate digital marketplaces to harvest credentials or payment details, though no specific brand impersonation or drainer kit has been confirmed. The infrastructure appears designed to mimic authentic e-commerce platforms, potentially exploiting users searching for in-game items, software licenses, or other virtual goods. Infrastructure analysis reveals the domain was registered on March 10, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, which is part of a network with a history of hosting malicious content. VirusTotal reports 7 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The site employs Cloudflare services, including HTTP/3 and Browser Insights, likely to obfuscate its origin and evade detection. No entries for this domain were found in Google Safe Browsing at the time of analysis. As of the latest assessment, skirbox.com has been taken offline, reducing immediate exposure to potential victims. However, the domain remains registered, and the infrastructure could be reactivated or repurposed for future campaigns. The elevated risk level persists due to the domain's recent creation, use of anonymization services, and prior malicious classification. Organizations are advised to monitor for related indicators, including the IP address and registrar, and implement proactive blocking measures to prevent access to this or similar domains. Users should verify digital marketplaces through official channels and avoid entering credentials or payment details on unverified platforms.