skinwut[.]com

The domain skinwut.com has been identified as a credential theft operation targeting users of a popular skin care brand. Analysis indicates the site is designed to harvest login credentials through deceptive login portals mimicking legitimate brand interfaces. As of the latest assessment, the domain is currently offline, though prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, an unusual future date that may indicate registration data manipulation. The domain resolved to the IP address 104.21.25.245, a Cloudflare-associated address often leveraged to obscure hosting origins. Security vendor detections include 4 of 95 flags on VirusTotal, while additional threat intelligence sources report its presence on one security blocklist. The domain also received a trust score of 0 out of 100 from independent analysis platforms, further corroborating its malicious classification. Current status confirms the domain has been taken offline, though the infrastructure remains a potential risk for future abuse. Organizations and users are advised to block the domain and associated IP at the network perimeter. Security teams should monitor for similar domains registered under the same registrar or resolving to the same IP range. End users should verify brand authenticity through official channels and report any suspicious login prompts to their security providers.