skin-baron[.]com

This domain is classified as a high-risk generic phishing threat, specifically targeting users seeking Counter-Strike skins. The infrastructure mimics legitimate gaming marketplaces to deceive victims into disclosing credentials or financial information. Analysis indicates the domain is currently offline, but historical data reveals persistent malicious intent. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 15 out of 95 security vendors on VirusTotal, registered through NameCheap, Inc., and resolves to IP address 188.114.97.3. It was created on April 30, 2026, and appears on three security blocklists. Additional detections include associations with two threat intelligence pulses on AlienVault OTX and a Gridinsoft trust score of 0/100. The domain is blocked by MetaMask, PhishDestroy, and SEAL. Detected technologies include WordPress, MySQL, PHP, jQuery UI, jQuery Migrate, jQuery, HSTS, and CookieYes, which may indicate an attempt to appear legitimate while concealing malicious functionality. Mitigation steps for this specific threat type include verifying domain authenticity before engaging with skin-trading platforms. Users should cross-reference the domain creation date (April 30, 2026) with official marketplace timelines, as legitimate platforms typically have longer histories. Blocklist integration at the network or endpoint level is recommended to prevent access. If credentials were entered on this domain, immediate password resets and multi-factor authentication enforcement are advised. Organizations should monitor for related indicators, including the resolving IP (188.114.97.3) and associated technologies, to detect potential lateral movement or secondary infections.