mushroom[.]skin

The domain mushroom.skin has been identified as a potential threat for credential theft. This domain does not appear to impersonate a specific brand or use a crypto drainer kit, but its purpose is to trick users into revealing sensitive information such as usernames and passwords.

Infrastructure analysis reveals that mushroom.skin has a VirusTotal detection score of 3/95, indicating that a minority of security vendors recognize it as malicious. The domain is registered through NameSilo, LLC and resolves to the IP address 45.67.85.152. It was created on April 04, 2026, and currently has a Gridinsoft trust score of 0/100, which is the lowest possible rating. The domain has been mentioned in 4 threat intelligence pulses on AlienVault OTX and appears on 2 security blocklists, specifically PhishDestroy and ScamSniffer. According to recent checks, the domain is currently offline.

The current status of mushroom.skin is offline, which reduces the immediate risk of active exploitation. However, the domain's history and current blocklist presence indicate it has been used for malicious purposes. It is recommended that users and organizations continue to monitor for any reactivation of this domain and avoid visiting it. Network administrators should consider adding this domain to their blocklists to prevent any potential future phishing attempts. The offline status and existing security measures mitigate the threat, but vigilance is necessary to ensure ongoing protection.