skin-baron[.]at

The domain skin-baron.at is flagged as a high-risk brand impersonation domain, specifically targeting an investment scam. The domain uses a deceptive page title, 'Skinbaron: Buy CS2 Skins | Secure Trading Platform 2025,' to lure unsuspecting users into believing they are visiting a legitimate trading platform.

Infrastructure analysis reveals that skin-baron.at resolves to the IP address 188.114.97.3 and was created on April 15, 2026. The domain is registered through Hosting concepts B.V. / Registrar.eu, a registrar listed under the nic.at registry. A VirusTotal scan indicates that 12 out of 95 security vendors flag this domain as malicious. The domain appears on 3 security blocklists, and its Gridinsoft trust score is 0 out of 100. The technologies detected on the domain include Bootstrap, jsDelivr, Cloudflare Browser Insights, and Cloudflare, which are commonly used to enhance the legitimacy and user experience of phishing sites.

The domain is currently active and poses a significant risk to users who may be tricked into providing sensitive information or financial details. Immediate response actions include blocking the domain at the network level, educating users about the specific threat, and monitoring for any related domains or IP addresses. Despite the current blocklists and security vendor flags, the domain remains a threat due to its high Gridinsoft risk score and the potential for rapid changes in its infrastructure and tactics.