skin-box[.]net

The domain skin-box.net was created on March 5, 2026 and is currently active. It is hosted behind Cloudflare with the authoritative name servers aitana.ns.cloudflare.com and coen.ns.cloudflare.com. The site presents a Russian‑language title that mimics a legitimate CS2 case‑opening service, suggesting a credential‑harvesting intent.

Technical resolution shows the hostname maps to IP address 104.21.89.205, which belongs to the Cloudflare network (AS13335, United States). The TLS certificate is issued by Let’s Encrypt (E7), and the HTTP response returns status 200. Detection infrastructure reports two of ninety‑five VirusTotal scanners flagging the domain, representing a 2 % flag rate, while PhishDestroy has added it to its blocklist, resulting in one security blocklist entry. The Gridinsoft trust score of 0/100 further indicates a high likelihood of abuse.

Evidence of the actual malicious payload is limited to the landing page content and the observed brand impersonation. No additional URLs, download links, or credential‑submission endpoints have been publicly disclosed, leaving the precise phishing workflow uncertain. Further analysis of the page source and any submitted form data is required to confirm the exact exfiltration path. The absence of broader detection across multiple vendors suggests the campaign may be in an early stage or employing evasion techniques that avoid automated analysis.

Defenders should treat skin-box.net as high‑risk and enforce network‑level blocking or sink‑hole redirection for any traffic to the domain. Continuous monitoring of DNS queries and TLS handshakes is advised, as changes to the underlying IP or certificate could indicate a shift in hosting. Updating URL filtering policies to include the observed nameservers and adding the domain to threat‑intelligence feeds will reduce exposure. Organizations using email gateways should also flag any messages containing links to this domain as suspicious.