skjnbox[.]com

The domain skjnbox.com has been identified as a generic phishing site designed to impersonate payment portals, likely targeting financial credentials or transaction data. Analysis indicates the domain is currently offline, though prior activity suggests it was actively used for fraudulent purposes. No specific brand affiliation has been confirmed, but the infrastructure aligns with credential harvesting tactics commonly employed in payment-related phishing schemes. Infrastructure analysis reveals the domain was flagged by 7 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an unusually future-dated registration that may suggest typosquatting or preemptive domain abuse. The domain resolves to the IP address 188.114.96.3 and appears on one security blocklist. Additional threat intelligence sources, including AlienVault OTX, associate it with a single threat intelligence pulse, while Gridinsoft assigns it a trust score of 0/100, reinforcing its malicious classification. Current status confirms skjnbox.com is offline, though the underlying infrastructure remains a potential risk for future abuse. Organizations are advised to block the domain and its associated IP (188.114.96.3) at the perimeter to prevent accidental access. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range, as these may indicate coordinated phishing campaigns. End-users should be educated on recognizing payment portal phishing attempts, particularly those involving unsolicited transaction requests or credential submission prompts.