skivbox[.]com

This domain, skivbox.com, is identified as a phishing site targeting Russian-speaking users with fraudulent offers of digital goods. The page title, "Лучшие цифровые предметы только у нас!" (translated: "Best digital items only with us!"), suggests a focus on selling in-game items, virtual currency, or other digital assets, likely through deceptive payment methods. No direct brand impersonation is evident, but the infrastructure aligns with low-sophistication phishing operations distributing fake digital products or crypto drainer kits. The site does not appear to use a known public drainer kit, though further analysis of archived content would be required to confirm payload delivery mechanisms. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 10, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with abuse. It resolves to the IP address 188.114.97.3, which is part of a content delivery network known for hosting both legitimate and malicious content. VirusTotal detection shows 14 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by at least one anti-phishing system. Technologies detected include Unpkg, Cloudflare, AOS, and HTTP/3, indicating the use of modern web frameworks and performance optimizations, though these are not inherently malicious. As of the latest verification, skivbox.com has been taken offline, reducing immediate exposure risk. However, the domain remains registered, and the infrastructure could be reactivated or repurposed for future campaigns. Users who interacted with the site prior to takedown may still be at risk of follow-up attacks, such as credential theft or malware delivery. Recommendations include monitoring for renewed activity, blocking the domain and associated IP at network perimeters, and advising potentially affected users to reset credentials for any accounts linked to digital purchases or crypto wallets. The elevated risk classification reflects the domain's recent malicious activity and the potential for re-emergence.