sklnbox.net — Cryptocurrency Drainer Detected & Blocked

PhishDestroy identifies the domain sklnbox.net as an active cryptocurrency drainer kit, flagged by security vendors with an elevated risk level. This domain is a recent addition to the threat landscape, created on April 24, 2026, and resolves to the IP address 188.114.97.3. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and secured with a Let’s Encrypt SSL certificate, which may lend it an air of legitimacy to unsuspecting users.

This domain exhibits multiple technical indicators of malicious intent. According to VirusTotal, 2 out of 95 security vendors flagged sklnbox.net as malicious, indicating a low but present detection rate among security tools. The domain was created on April 24, 2026, and is associated with the IP address 188.114.97.3. NICENIC INTERNATIONAL GROUP CO., LIMITED is listed as the registrar, and the domain is not currently flagged in Google Safe Browsing (GSB). Despite its recent creation, the domain has not yet been widely blocked, underscoring the need for proactive monitoring.

As of the latest analysis, sklnbox.net remains active and poses an elevated risk to potential victims. PhishDestroy recommends immediate action to block this domain at the network level and advises users to avoid interacting with any associated links or websites. While the current risk is elevated, the domain’s low VirusTotal detection rate suggests that threat intelligence sharing and updated blocklists are critical to mitigating its impact. Remaining risk is moderated by the domain’s recent creation but could escalate if the drainer kit gains traction among cybercriminals.