skisbox[.]com

The domain skisbox.com has been confirmed as a phishing site targeting users with fraudulent offers of digital goods. Analysis indicates the site operated as a fake storefront, presenting itself as a vendor of digital items with the page title "Лучшие цифровые предметы только у нас!" (translated: "Best digital items only with us!"). No specific brand impersonation was detected, but the site employed deceptive tactics to lure victims into financial transactions for non-existent products. The domain is currently offline, though prior activity suggests it may have been part of a broader campaign to defraud users seeking virtual goods or in-game items. Infrastructure analysis reveals the domain was registered on March 10, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolved to the IP address 188.114.97.3, which is part of a network known for hosting malicious content. The site was flagged by 5 of 95 security vendors on VirusTotal, indicating moderate detection but sufficient evidence to classify it as malicious. Additionally, it appeared on one security blocklist and was blocked by PhishDestroy. Technologies detected on the domain included Unpkg, Cloudflare Browser Insights, Cloudflare (likely used for anonymization), AOS (Animate On Scroll library), and HTTP/3, which are not inherently malicious but are often leveraged to obfuscate phishing infrastructure or enhance user engagement. As of the latest assessment, skisbox.com is offline, though its prior registration date suggests it may have been prepared for future use or was taken down due to enforcement actions. Organizations and users are advised to treat any past or future interactions with this domain as malicious. Network administrators should block the domain and its associated IP (188.114.97.3) at the perimeter level. Users who may have engaged with the site should monitor financial accounts for unauthorized transactions and consider resetting credentials for any accounts accessed during the interaction. Vigilance is recommended, as domains registered through high-risk registrars often reappear under similar names or infrastructure.