skin-loot[.]icu

The domain skin-loot.icu is identified as a credential harvesting phishing site targeting users through fraudulent access verification pages. Analysis confirms this domain is currently offline, though it previously hosted active phishing infrastructure designed to capture login credentials under the pretense of account verification processes. No specific brand impersonation has been confirmed, but the generic "Access Verification" page title suggests broad targeting of authentication systems across multiple platforms.

Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 94.183.188.179 and has been flagged by 14 of 95 security vendors on VirusTotal, indicating widespread detection. It appears on one security blocklist and has been documented in one AlienVault OTX threat intelligence pulse. The Gridinsoft trust score for this domain is 0/100, further confirming its malicious nature. Additional technical indicators include the use of a newly registered domain (NRD) with no legitimate history, a common tactic in phishing campaigns to evade reputation-based filters.

While skin-loot.icu is currently offline, the infrastructure remains a latent threat. Organizations and individuals should treat this domain as compromised and implement the following measures: block the domain and associated IP (94.183.188.179) at the network perimeter, update endpoint protection signatures to include this indicator of compromise (IOC), and monitor for any resurgence of activity. Users who may have interacted with this domain should immediately reset credentials for any accounts accessed during the exposure window. Given the domain's recent creation and lack of legitimate use, it should be permanently classified as malicious in all security systems.