skin-box[.]org

PhishDestroy identifies skin-box.org as an active phishing domain leveraging a generic drainer kit to harvest cryptocurrency and credentials from unsuspecting skincare shoppers. The domain employs social-engineering lures centered on high-demand beauty products, tricking users into completing fraudulent checkout flows that siphon payment card data and crypto wallet keys. No brand is directly mimicked in the payload, indicating a standalone operation targeting beauty e-commerce demand surges. skin-box.org exhibits the following technical indicators: VirusTotal detection score of 0 detections out of 95 scanners as of seed 462db9, a Let’s Encrypt SSL certificate, IP resolution to 172.67.157.57, domain creation timestamp of April 08, 2026 (future-dated registration), and NICENIC INTERNATIONAL GROUP CO., LIMITED as registrar. Google Safe Browsing (GSB) and major blocklists currently show no listings, providing zero upstream protection for end users. The domain remains active with an under-investigation status. PhishDestroy recommends immediate network and endpoint blocklisting of skin-box.org and 172.67.157.57 via DNS, firewall, and endpoint detection rules. Users should avoid direct visits, clear browser cache and cookies, and audit recent skincare transactions for signs of fraud. Remaining risk is assessed as HIGH due to zero detections and fresh registration, enabling rapid campaign expansion before blacklists catch up.