skinwouse[.]com

This domain, skinwouse.com, is identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates no direct association with known brand impersonation or drainer kit signatures, suggesting a custom-built or low-sophistication phishing framework. The domain exhibits generic phishing characteristics, including fake authentication portals designed to capture sensitive credentials such as usernames, passwords, and multi-factor authentication codes. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.135.61 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026. Security vendor detections on VirusTotal stand at 2/95, while the domain appears on a single security blocklist and is flagged in one threat intelligence pulse on AlienVault OTX. The GridinSoft trust score for this domain is 0/100, further corroborating its malicious classification. No entries were found in Google Safe Browsing at the time of assessment. The domain is currently offline, having been taken down following detection and blocking by security systems. Despite its inactive status, residual risk remains due to the potential reuse of associated infrastructure or registration patterns by threat actors. Users who may have interacted with the domain are advised to reset credentials for any accounts accessed during the exposure window and monitor for unauthorized activity. Organizations should update blocklists to include the domain and its resolved IP to prevent future access attempts.