skinwatch[.]info

The domain skinwatch.info was registered through NameCheap on 20 May 2026 and presently resolves to the Cloudflare‑managed address 104.21.33.168. The authoritative name servers are jerry.ns.cloudflare.com and laura.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare’s CDN and DDoS protection service. A static page with the title “Inventory Check | Fortnite” is served from the domain, suggesting an attempt to lure victims by referencing the popular Fortnite brand, although no further content analysis is available. VirusTotal has recorded detections from 16 of 95 scanning engines, and the domain is listed on at least one public security blocklist. It is actively blocked by the PhishDestroy feed, confirming that threat‑intel platforms consider it malicious. The infrastructure remains online as of 19 July 2026, and the risk rating is high. Uncertainty remains regarding the exact phishing kit, credential‑harvesting mechanisms, or any command‑and‑control components, as no payload samples or network traffic have been disclosed. Defenders should block DNS resolution to skinwatch.info, add the IP 104.21.33.168 to firewall deny lists, and monitor for any outbound connections to the domain. Email security gateways should be updated to flag messages that contain references to “Inventory Check” or Fortnite‑related lure text originating from this domain. Continuous re‑evaluation is advised in case additional indicators, such as malicious scripts or credential‑stealing forms, emerge.