skinclub[.]wales

The domain skinclub.wales is presently active and serves a page titled “Skinclub – Official CS2 Skin Case Site In UK”. DNS resolution points to IP 104.21.81.102, which is hosted by Cloudflare, Inc. in Canada. The site is protected by a Let's Encrypt certificate (CN=YE2) and delivers content over HTTP/3, with server‑side technologies identified as PHP and Cloudflare Browser Insights. VirusTotal records show 15 of 91 security vendors flagging the domain, indicating a moderate level of detection across the scanning community. The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX lists the host in four distinct threat‑intel pulses, further corroborating its malicious reputation. Registration was performed through Dynadot, LLC on May 04 2026. An HTTP 404 response is returned for the root path, suggesting that the malicious payload may reside on a sub‑path not captured by the initial request. Current intelligence does not reveal the exact phishing kit or the credential‑harvesting mechanism employed, and the page content beyond the title has not been publicly dissected. Defenders should implement DNS‑level denylisting for skinclub.wales, enforce TLS inspection to capture any hidden sub‑resources, and monitor for outbound connections to the associated Cloudflare IP range. Continuous telemetry collection on related HTTP requests and correlation with the OTX pulses will aid in early detection of compromised users.