skrill-app[.]top

This domain is flagged as a high-risk credential harvesting phishing site designed to deceive users into submitting login credentials. Analysis indicates the infrastructure is specifically crafted to impersonate financial service portals, likely targeting users of payment platforms. The page title 'Login' and absence of legitimate branding further support the assessment of malicious intent. Infrastructure analysis reveals the domain skrill-app.top was registered on December 14, 2025, through 耐思尼克国际集团有限公司, a registrar frequently associated with malicious registrations. It resolves to IP address 144.31.244.50, hosted under AS213877 (U1 DIGITAL SERVICES LTD) in Germany. The domain is currently offline but was previously detected by 18 out of 95 security vendors on VirusTotal. It appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. The SSL certificate is classified as R13, indicating a low-trust or self-signed certificate commonly used in phishing campaigns. Mitigation steps for this threat type include immediate blocking of the domain and its resolving IP (144.31.244.50) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) across endpoint detection and response (EDR) systems, firewalls, and email gateways to prevent user access. User awareness training should emphasize verifying domain authenticity before entering credentials, particularly for financial services. Monitoring for similar domains registered through the same registrar or resolving to the same IP range is recommended to identify related threats. If credentials were exposed, affected accounts should be locked, passwords reset, and multi-factor authentication enforced.