skrill-app[.]co[.]com

This domain, skrill-app.co.com, is a confirmed phishing infrastructure designed to impersonate the Skrill payment platform while specifically targeting Ethereum cryptocurrency users. Analysis indicates the site operates as a crypto drainer, a type of malicious infrastructure that tricks victims into connecting their cryptocurrency wallets to fraudulent interfaces, enabling unauthorized transfers of digital assets. The page title, 'Skrill Login | Skrill Account | Skrill,' mimics legitimate Skrill branding to deceive users into entering sensitive credentials or wallet access details, which are then harvested for financial theft. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to IP address 104.21.47.246, hosted on Cloudflare’s network (AS13335), a common tactic to obscure origin infrastructure. Despite its creation date of August 16, 1997, registered through Moniker Online Services LLC, the domain exhibits characteristics inconsistent with legitimate long-standing services, including the absence of an SSL certificate. Security vendors on VirusTotal flagged this domain at a ratio of 17 out of 95, and it appears on five independent blocklists, including PhishDestroy and PhishingDB. The domain has since been taken offline, though its prior operational status poses residual risk to users who may have interacted with it. Users who visited skrill-app.co.com or entered credentials on the site should immediately revoke access to any connected cryptocurrency wallets and transfer remaining assets to a new, secure wallet. All passwords associated with the impersonated service should be changed, and multi-factor authentication should be enabled on all financial and cryptocurrency accounts. Given the high-risk nature of crypto drainers, affected users are advised to monitor transaction histories for unauthorized activity and report the incident to relevant financial and cybersecurity authorities. The absence of SSL encryption further underscores the domain’s fraudulent intent, as legitimate financial platforms universally enforce encrypted connections.