oilkinronssbase[.]org

Oilkinronssbase.org was registered on May 26, 2025 through Dynadot Inc. The domain is delegated to Cloudflare nameservers angela.ns.cloudflare.com and vasilii.ns.cloudflare.com, indicating use of Cloudflare’s DNS and possibly its proxy services. DNS resolution points to the IP address 172.67.223.102, an address belonging to Cloudflare’s global edge network, which masks the true hosting location and complicates attribution. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one anti‑phishing service has observed malicious activity associated with the host. VirusTotal analysis shows that 3 out of 91 scanned security vendors flagged the domain, providing independent corroboration of its malicious nature.

The modest detection count suggests that the site may be newly active or employing techniques that evade many scanners, but the presence of any detections aligns with the high‑risk rating assigned in internal assessments. No additional public intelligence such as Google Safe Browsing or OTX entries is currently available for this domain. The combination of recent registration, use of a reputable registrar, Cloudflare front‑end services, and detection by multiple vendors points to a deliberately concealed phishing infrastructure.

However, the limited number of blocklist entries and the absence of detailed page‑title or brand‑target information leave the exact phishing campaign context uncertain. Defenders should prioritize blocking the domain at network perimeter devices, add the IP address 172.67.223.102 to deny‑list rules where feasible, and monitor DNS queries for the associated Cloudflare nameservers. Continuous re‑scanning on VirusTotal and inclusion in internal URL reputation feeds are recommended to capture any evolution in the site’s payload or hosting changes.