skinsmonkey[.]main-place[.]com

Analysis of skinsmonkey.main-place.com shows a newly created domain (registration date 2026-02-21) that resolves to the IPv6 address 2a06:98c1:3120::3, hosted by Cloudflare (ASN 13335) in the United States. The site presented the page title "Inloggen", a Dutch term for "login", which aligns with typical credential‑harvesting behaviour. The TLS certificate is issued by GTS CA 1P5, a publicly trusted CA, indicating the use of a standard SSL certificate rather than a self‑signed or anomalous one.

The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy service, confirming that at least one security feed has identified it as malicious. VirusTotal recorded scans from 93 independent vendors; none reported a detection at the time of review, but the lack of detections does not constitute evidence of benign intent. Current network observations list the domain as offline, suggesting the operator has either taken it down or is rotating infrastructure.

Defenders should continue to deny any HTTP or HTTPS traffic to the associated IP range, add the domain to internal blocklists, and monitor for re‑registration or revival of the same host name. Additionally, security teams should watch for similar domains that share the "Inloggen" title pattern or use the same Cloudflare ASN, as threat actors often reuse these components. Until further forensic evidence emerges, the prudent stance is to treat the domain as a confirmed phishing vector and maintain strict filtering controls.