bnbchainskills[.]com

This domain, bnbchainskills.com, is currently under investigation for phishing activity targeting users of the BNB Chain ecosystem. Analysis indicates the site impersonates the BNB Chain Skills Hub, presenting itself as an "AI Agent Skills Registry" to deceive visitors into interacting with fraudulent content. The domain is actively resolving and has not yet been flagged by security vendors for malicious behavior, though it exhibits characteristics consistent with brand impersonation and credential harvesting schemes. Infrastructure analysis reveals the domain was registered on March 10, 2026, through GoDaddy.com, LLC, an atypical registration pattern for legitimate BNB Chain-affiliated properties. It resolves to the IP address 185.199.110.153, hosted on AS54113 (Fastly, Inc.) in the United States. At the time of assessment, the domain appears on one security blocklist, while VirusTotal reports 0 detections out of 95 vendors, suggesting limited visibility or evasion of current detection mechanisms. The site employs a Let's Encrypt SSL certificate (R13), which, while providing encryption, does not validate the legitimacy of the content served. Current status remains active, with no takedown or sinkholing observed. Given the domain's recent registration date, lack of detection by major security engines, and impersonation of a high-value blockchain brand, this represents a moderate to high-risk phishing threat. Recommendations include immediate blocking of the domain and IP at the network perimeter, monitoring for related indicators of compromise (IOCs) such as the SSL certificate thumbprint or registrar details, and alerting users to verify the authenticity of any BNB Chain-related services before interaction. Organizations should also consider proactive hunting for connections to this domain in proxy logs or endpoint telemetry to identify potential compromised accounts or data exfiltration attempts.