skinqouse[.]com

Analysis indicates that skinqouse.com was registered on March 05, 2026 through NiceNIC International Group Co., Limited. The domain resolved to the Cloudflare edge address 104.21.30.236, which is associated with AS13335 Cloudflare, Inc. in the United States. DNS resolution employed the Cloudflare authoritative name servers melinda.ns.cloudflare.com and nicolas.ns.cloudflare.com, and the site was observed to serve traffic over HTTP/3 without an SSL/TLS certificate, suggesting that the connection was not encrypted. The page title captured from the live host, “Игровая платформа – Открытие ящиков”, is written in Russian and translates to “Gaming platform – Box opening”, consistent with a generic phishing campaign that targets users interested in virtual rewards.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in malicious intent. VirusTotal reported that 2 of 94 scanned security vendors flagged the domain, and the site appears on a single public blocklist. Additionally, the anti‑phishing service PhishDestroy listed skinqouse.com as blocked. At the time of reporting (July 24, 2026) the domain is offline, limiting immediate observation of the payload.

No SSL certificate was present, and no further threat‑intel such as known malware families, exploit kits, or compromised credentials has been disclosed. Consequently, the full scope of the phishing infrastructure – including any backend command‑and‑control servers or credential‑harvesting pages – remains unknown. Defenders should continue to monitor the IP address 104.21.30.236 for any resurgence of malicious activity, enforce blocklisting of the domain in web filters, and propagate the observed indicators (domain name, IP, nameservers, page title) to shared threat‑intelligence platforms. Organizations employing URL reputation services should ensure that skinqouse.