skinobox[.]com

The domain skinobox.com has been confirmed as a credential theft operation targeting users of the popular first-person shooter Counter-Strike 2 (CS2). Analysis indicates this site operates under the guise of a legitimate skin gambling platform, enticing victims with promises of high-value in-game item drops from virtual cases. The specific threat type involves credential harvesting, where users are prompted to log in with their gaming platform accounts, unknowingly surrendering access to their inventories and personal data. Infrastructure analysis reveals multiple high-risk indicators. The domain is flagged by 3 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on one security blocklist and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with fraudulent domains. The site resolves to IP address 172.67.141.178, hosted on a content delivery network that obscures the true origin. Notably, the domain was created on March 27, 2026, an anomalous future date suggesting either a registration error or deliberate obfuscation. AlienVault OTX records show the domain in one threat intelligence pulse, while PhishDestroy has already implemented blocking measures. Current status shows the domain has been taken offline, though the infrastructure may remain dormant for reactivation. The elevated risk level stems from the targeted nature of the attack, focusing on a gaming community with valuable digital assets. Users are advised to immediately revoke any account access granted to this domain and enable multi-factor authentication on all gaming platforms. Organizations should update security blocklists with the domain and IP address, while monitoring for similar patterns in newly registered domains. The anomalous creation date and gambling-themed credential harvesting warrant particular scrutiny in threat detection systems.