tnsq7j39e6[.]skywork[.]website

This domain, tnsq7j39e6.skywork.website, is identified as a high-risk phishing infrastructure specifically designed to impersonate Stripe payment portals. Analysis indicates the site employs fraudulent checkout forms to harvest financial credentials, including credit card details and login information. The use of Stripe’s legitimate payment processing technology, combined with tracking tools like Google Analytics and Facebook Pixel, suggests an attempt to create a convincing replica of authentic payment gateways, increasing the likelihood of successful credential theft. Evidence supporting this assessment includes detection by 2 out of 95 security vendors on VirusTotal, a relatively low but notable blocklist count that may indicate early-stage deployment. The domain was registered on August 05, 2025, through Alibaba Cloud Computing Ltd. d/b/a HiChina, a registrar frequently associated with newly created malicious domains. Infrastructure analysis reveals the domain resolves to the IP address 47.85.109.221, and it employs an SSL certificate issued by DigiCert Inc, which may lend a false sense of legitimacy to unsuspecting users. The presence of HTTP/3 and modern web frameworks like Vue.js further suggests an effort to evade traditional detection mechanisms. Users who have visited tnsq7j39e6.skywork.website or entered credentials on the site should immediately revoke any submitted information, particularly financial details. It is recommended to monitor associated accounts for unauthorized transactions and enable multi-factor authentication where available. System scans using updated security tools should be conducted to detect potential malware or persistent threats. Organizations should block the domain and its resolving IP at the network level to prevent further exposure. Given the domain’s recent creation and active status, heightened vigilance is advised for any communications or transactions linked to this infrastructure.