fortskin[.]sbs

Analysis of fortskin.sbs indicates a high-risk phishing domain targeting users of online skin trading platforms. The domain was registered on July 3, 2026, through HOSTINGER operations, UAB, and currently resolves to the IP address 193.187.110.3. Infrastructure analysis reveals the use of DNSPod nameservers (a.dnspod.com, b.dnspod.com, c.dnspod.com), a common configuration for domains involved in fraudulent activity. As of July 31, 2026, the domain remains active and is flagged by one security blocklist, including PhishDestroy.

VirusTotal reports that 4 out of 91 security vendors detect this domain as malicious, though the specific nature of the threat—such as whether it employs credential harvesting, malware distribution, or fraudulent transactions—remains unconfirmed due to limited technical analysis of the site content. Defenders should treat this domain as an active threat. The IP address 193.187.110.3 should be monitored for additional malicious domains, and network-level blocking is recommended.

Given the domain's recent registration and association with a known phishing blocklist, organizations should prioritize reviewing logs for connections to this domain, particularly from systems or users involved in gaming or digital asset trading. No evidence currently links this domain to a specific phishing kit or brand beyond its apparent focus on skin trading, so further investigation into its payload or backend infrastructure is advised. If internal telemetry confirms interaction with this domain, incident response procedures should be initiated to assess potential credential exposure or financial fraud.