# PhishDestroy threat dossier — oilkinronssbase.org ================================================================ Fetched: 2026-07-29 14:59:25 UTC Canonical: https://phishdestroy.io/domain/oilkinronssbase.org/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 5/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Fortinet, Gridinsoft, Netcraft, SOCRadar AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.67.223.102 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: Dynadot Inc Nameservers: angela.ns.cloudflare.com, vasilii.ns.cloudflare.com Registered: 2025-05-26 Expires: 2027-05-26 Page title: oilkinronssbase.org HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-10-06 Status: INVALID chain Fingerprint: 2e64efd8ef466ef184f1f2b79b9736a807fbb46a05b08598f151c70730230a36 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2025-05-26 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-27 07:11:29 UTC (by PhishDestroy tracker) First reported: 2026-07-27 08:31:34 UTC (abuse notice filed) Last verified: 2026-07-29 16:20:25 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019fa208-e2ad-701e-8dbe-a3cdb1a64db4/ URLQuery: https://urlquery.net/report/5f806f6d-83fe-4ebe-91df-9e338d0291e4 Wayback Machine: https://web.archive.org/web/*/oilkinronssbase.org crt.sh CT logs: https://crt.sh/?q=%25.oilkinronssbase.org Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=oilkinronssbase.org AlienVault OTX: https://otx.alienvault.com/indicator/domain/oilkinronssbase.org URLhaus: https://urlhaus.abuse.ch/host/oilkinronssbase.org/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-27 07:12:25 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] oilkinronssbase.org: Confirmed Phishing Site Oilkinronssbase.org was registered on May 26, 2025 through Dynadot Inc. The domain is delegated to Cloudflare nameservers angela.ns.cloudflare.com and vasilii.ns.cloudflare.com, indicating use of Cloudflare’s DNS and possibly its proxy services. DNS resolution points to the IP address 172.67.223.102, an address belonging to Cloudflare’s global edge network, which masks the true hosting location and complicates attribution. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one anti‑phishing service has observed malicious activity associated with the host. VirusTotal analysis shows that 3 out of 91 scanned security vendors flagged the domain, providing independent corroboration of its malicious nature. The modest detection count suggests that the site may be newly active or employing techniques that evade many scanners, but the presence of any detections aligns with the high‑risk rating assigned in internal assessments. No additional public intelligence such as Google Safe Browsing or OTX entries is currently available for this domain. The combination of recent registration, use of a reputable registrar, Cloudflare front‑end services, and detection by multiple vendors points to a deliberately concealed phishing infrastructure. However, the limited number of blocklist entries and the absence of detailed page‑title or brand‑target information leave the exact phishing campaign context uncertain. Defenders should prioritize blocking the domain at network perimeter devices, add the IP address 172.67.223.102 to deny‑list rules where feasible, and monitor DNS queries for the associated Cloudflare nameservers. Continuous re‑scanning on VirusTotal and inclusion in internal URL reputation feeds are recommended to capture any evolution in the site’s payload or hosting changes. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260727-A402F7 Favicon MD5: 0b65b9d7df7d52012b2de33e2b649b8e TLS cert SHA-256: 2e64efd8ef466ef184f1f2b79b9736a807fbb46a05b08598f151c70730230a36 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/oilkinronssbase.org/ JSON API: https://api.destroy.tools/v1/check?domain=oilkinronssbase.org Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,481 domains (83,248 alive under monitoring, 109,716 confirmed takedowns/dead). Site: https://phishdestroy.io