lis-skin[.]ru[.]com

Analysis of lis-skin.ru.com shows a newly registered domain created on 5 March 2026 that resolves to the IPv4 address 5.188.166.29. The IP belongs to AS56694, an ASN operated by LLC Smart Ape in the Russian Federation. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy feed. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious use.

The registrar is listed as Sav.com, LLC and the authoritative name servers are ns1.centralnic.net, ns2.centralnic.net, ns3.centralnic.net, and ns4.centralnic.net. No TLS certificate is presented for the host, and the current HTTP status is reported as offline, confirming that the site has been taken down. VirusTotal reports indicate that the domain was scanned by 94 antivirus and URL‑reputation vendors, none of which raised a detection at the time of scanning. While the absence of detections does not prove benign intent, it does not contradict the other indicators of compromise.

The combination of a recent registration, low trust score, blocklist presence, and association with a known phishing‑blocking service aligns with the classification of a generic phishing infrastructure. Defenders should add 5.188.166.29 to network‑level deny lists, monitor any future DNS resolution attempts for lis‑skin.ru.com, and enforce URL filtering rules that block the domain across web gateways. Continuous re‑evaluation is recommended in case the infrastructure is re‑activated or repurposed. Indicators of compromise (IoC) for this case include the domain name, the IP address, the registrar, and the listed name servers.