skyrimbk[.]com

PhishDestroy identifies skyrimbk.com as a live crypto-draining site designed to trick visitors into connecting crypto wallets under the guise of downloading Skyrim mods. The domain mimics well-known modding communities to lure players who seek free or early-access content. Once loaded, the page silently injects malicious JavaScript that, upon wallet connection, requests dangerous permissions such as “Sign all transactions” or “Enable spending approvals.” Unsuspecting users then authorize token transfers or NFT approvals that drain funds directly from their wallets without additional prompts. This domain was flagged by PhishDestroy on 2025-07-12. It was registered only days earlier—on July 12, 2025—through OwnRegistrar, Inc., a registrar frequently abused for short-lived malicious domains. Currently the site resolves to the IPv4 address 163.61.188.5 and uses a Let’s Encrypt SSL certificate to appear legitimate. VirusTotal scanning shows only 1 out of 95 participating security vendors has detected the threat, leaving most users vulnerable to the site’s crypto-draining payload. If you visited skyrimbk.com, immediately disconnect your wallet from any dApp or website and revoke any token or NFT approvals you may have granted. Use tools like Etherscan’s Token Approval or Revoke.cash to check and revoke suspicious approvals across Ethereum and other EVM chains. Consider moving remaining funds to a newly created wallet with no prior transaction history. Use a hardware wallet for high-value assets whenever possible and never approve wallet signatures on unfamiliar sites.