skinbox[.]win

This domain, skinbox.win, is flagged as a phishing site targeting users of online skin trading platforms, a niche often exploited for fraudulent transactions and credential harvesting. Visitors may encounter fake login pages, payment forms, or account verification prompts designed to steal sensitive information such as usernames, passwords, and payment details. The site mimics legitimate skin trading services, leveraging social engineering to trick users into disclosing credentials or transferring virtual assets under false pretenses. Analysis indicates the domain is still active and resolves to the IP address 188.114.97.3, a host with no prior detections on VirusTotal (0/95 engines). The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy to phishing infrastructure. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed, suggesting early-stage detection. No creation date or registrar details are publicly confirmed, but the lack of widespread detection implies the campaign may still be in its initial deployment phase. Users who have visited skinbox.win or interacted with its content should immediately revoke any entered credentials, particularly for gaming or payment accounts. Enable multi-factor authentication on all linked services to mitigate unauthorized access. Monitor financial transactions for unusual activity, as stolen credentials may be used for fraudulent purchases or transfers. If the site was accessed via a link in an email or message, report the sender as phishing to the relevant platform. Security teams should add the domain and its resolving IP to blocklists to prevent further exposure within networks.