skendbux[.]com

Analysis of skendbux.com indicates that the domain was active for a brief period before being taken offline. The site was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to the IP address 188.114.96.3, which is associated with Cloudflare, Inc. (AS13335) and located in the United States. The authoritative nameservers are darwin.ns.cloudflare.com and sarah.ns.cloudflare.com, confirming Cloudflare as the DNS provider. No SSL certificate was observed for the host, meaning any traffic would have been unencrypted.

The page title returned by the web server is "Лучшие цифровые предметы только у нас!", a Russian phrase that translates to "Best digital items only with us!", suggesting the content was aimed at promoting digital goods in a phishing context. VirusTotal records show that three of ninety‑three scanning vendors flagged the domain, and it appears on a single external blocklist, with PhishDestroy explicitly listing it as blocked. The threat classification in the intelligence set identifies the campaign as social media phishing, which aligns with the use of a generic promotional title to lure victims. Because the domain is currently offline, active exploitation is unlikely, but the infrastructure—particularly the Cloudflare IP and the registrar—could be reused for future campaigns.

Defenders should add 188.114.96.3 to network blocklists, monitor for re‑registration of skendbux.com, and enforce outbound filtering for connections to Cloudflare‑hosted IP ranges that are not part of legitimate business traffic. Continued observation of the registrar NiceNIC and the associated nameservers is advisable, as they have been leveraged for malicious domains in the past. In the absence of SSL and with limited vendor detections, the risk is elevated but not yet quantified; therefore, proactive blocking and traffic monitoring are recommended to mitigate potential repeat abuse.