skindbux[.]com

Analysis of skindbux.com, observed on July 24, 2026, indicates that the domain was actively used for a social media phishing campaign before being taken offline. The site resolved to the IP address 172.67.205.128, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. The TLS certificate presented was issued by Google Trust Services under the WE1 designation, confirming the use of a legitimate certificate authority but offering no indication of content legitimacy. VirusTotal records show that two of ninety‑three scanning engines flagged the domain, suggesting limited detection by automated tools.

The domain appears on a single external blocklist and is explicitly listed by PhishDestroy, reinforcing the conclusion that it was identified as malicious by at least one dedicated anti‑phishing service. Technical profiling reveals the presence of Cloudflare services, HTTP/3 support, and third‑party libraries such as Unpkg and AOS, consistent with a modern web stack often leveraged to obscure malicious payloads. The page title, "Лучшие цифровые предметы только у нас!", is in Russian and translates to a promotional phrase, but no further content analysis is available. Registration data shows the domain was created on February 21, 2026, through NiceNIC International Group Co., Limited, and uses the Cloudflare authoritative nameservers amber.ns.cloudflare.com and stan.ns.cloudflare.com.

Current status is offline, limiting immediate observation of page behavior. Uncertainty remains regarding the specific social media platforms targeted and the exact credential‑ harvesting mechanisms employed, as no screenshots or form details have been released. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed IP and hostname, and monitor for any re‑use of the same infrastructure or certificate fingerprint in future campaigns.