skimport[.]com

The domain skimport.com has been identified as a high-risk crypto drainer phishing site, designed to illicitly extract cryptocurrency assets from victims through deceptive transaction prompts. As of the latest analysis, the domain is offline, though prior activity indicates it was actively targeting users with wallet-draining scripts. No direct brand impersonation has been confirmed, but the infrastructure aligns with known crypto-focused phishing campaigns. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on March 27, 2026, an unusually forward-dated creation that may suggest domain front-running or speculative registration. The domain is flagged by 17 of 95 security vendors on VirusTotal, with detections spanning heuristic, signature-based, and behavioral analysis. It appears on three independent security blocklists, including those specializing in financial fraud and cryptocurrency threats. The site was served via Cloudflare infrastructure, utilizing HTTP/3 for performance and potential evasion of legacy security controls. No associated IP addresses were directly linked to the domain at the time of takedown, though prior resolutions may have pointed to ephemeral hosting providers. Current status indicates the domain has been taken offline, likely due to enforcement actions or infrastructure disruption. However, the registration remains active, posing a residual risk of reactivation. Organizations and individuals are advised to block the domain at the DNS and network layers, monitor for related subdomains or typosquatting variants, and implement strict transaction verification protocols for cryptocurrency interactions. End-users should verify wallet addresses through trusted sources and employ hardware-based or multi-signature wallets to mitigate drainer script risks. Security teams are encouraged to review logs for prior connections to skimport.com and assess potential exposure.