skinhwuse[.]com

This domain, skinhwuse.com, is flagged as a generic phishing infrastructure designed to harvest user credentials through deceptive login interfaces. Analysis indicates no direct association with a specific brand or drainer kit, suggesting a broad-spectrum credential theft campaign. The domain operates without targeting a single entity, increasing its potential reach across multiple platforms or services. Infrastructure analysis reveals the following technical indicators: the domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 172.67.178.102. It was created on March 27, 2026, though this date may reflect backdating or registry manipulation. Security vendor detection on VirusTotal stands at 6/95, indicating moderate but not universal recognition. The domain appears on one security blocklist and is currently not listed in Google Safe Browsing. Its registration and hosting patterns align with known phishing infrastructure, including the use of bulletproof registrars and content delivery networks to obscure origin. As of the latest assessment, skinhwuse.com has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a latent threat due to the registrar’s history of hosting malicious domains and the domain’s prior resolution to a shared IP address with other suspicious sites. Users who interacted with the domain should assume credential exposure and initiate password resets on any accounts accessed during the period of activity. Organizations are advised to monitor for related indicators, including the IP 172.67.178.102 and registrar NICENIC INTERNATIONAL GROUP CO., LIMITED, in network logs to identify potential prior compromise.