skinyox[.]com

Analysis of the domain skinyox.com indicates it is an active social media phishing infrastructure, first registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain currently resolves to the IP address 104.21.39.181, hosted on Cloudflare's network in Canada, and uses Cloudflare nameservers (donovan.ns.cloudflare.com and macy.ns.cloudflare.com). The site returns an HTTP 200 status, suggesting it is operational, and its page title, displayed in Cyrillic as 'Лучшие цифровые предметы только у нас!', implies a focus on Russian-speaking users, though the exact nature of the phishing lure remains unconfirmed beyond the provided classification of social media phishing. Security vendors have flagged skinyox.com, with 13 out of 94 engines on VirusTotal detecting it as malicious. The domain appears in eight threat intelligence pulses on AlienVault OTX and is listed on at least one security blocklist, specifically PhishDestroy. A Gridinsoft trust score of 0/100 further supports its classification as high-risk. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare's services. Infrastructure analysis reveals no evidence of a known phishing kit or targeted brand beyond the social media classification. The domain's recent creation and continued activity, combined with its presence on multiple threat intelligence platforms, suggest it is part of an ongoing campaign. Defenders should prioritize blocking the domain and its resolving IP address, monitoring for related infrastructure, and alerting users to the risk of social media credential theft or fraudulent digital item scams. Further investigation into the site's content and backend connections is recommended to determine the full scope of the operation.