topskjn[.]com

PhishDestroy has identified topskjn.com as a confirmed phishing domain, classified under generic phishing activity. The domain does not impersonate a specific brand but exhibits classic phishing behavior, likely attempting to harvest credentials or deploy a crypto drainer. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to IP address 172.67.171.233, hosted behind Cloudflare infrastructure with an SSL certificate issued by Google Trust Services (WE1).

Technical indicators reveal a risk-elevated profile: VirusTotal flags it with a score of 5 out of 95 security vendors, indicating moderate but notable detection. The domain appears on one security blocklist and is recorded in one AlienVault OTX threat intelligence pulse. Created on March 27, 2026, its recent registration adds to the suspicious timeline. Google Safe Browsing status is not explicitly provided, but the domain's offline status suggests prior enforcement action.

Currently, topskjn.com is taken offline, reducing immediate risk to users. However, the domain may resurface under different hosting or registration details. Users who have interacted with this site should change passwords and monitor for unauthorized activity. PhishDestroy recommends verifying any unsolicited links through its platform and enabling multi-factor authentication. Remaining risk includes potential credential compromise or financial loss if credentials were entered. No further action is required from authorities as the site is already inactive.