onesecure-oils[.]info

Analysis of onesecure-oils.info indicates that the domain is actively used for credential phishing. The domain resolves to the IPv4 address 86.107.77.132 and is hosted on infrastructure that uses the dns1.tela-host.com and dn2.tela-host.com name servers. Registration data shows the domain was created on 18 December 2025 and was purchased through Dynadot Inc, a registrar that is frequently observed in malicious registrations.

The site presents a valid TLS certificate issued by Let’s Encrypt, which does not guarantee legitimacy but removes the obvious lack of encryption as a detection factor. Threat intelligence sources corroborate the malicious classification: the domain appears in two AlienVault OTX pulses, is listed on one public security blocklist, and is actively blocked by the PhishDestroy mitigation service. VirusTotal scans have resulted in four of ninety‑one security vendors flagging the domain as malicious, reinforcing the suspicion.

Current observations do not reveal additional infrastructure such as ASN or geographic details, and the page title or target brand has not been publicly disclosed. Defenders should treat the domain as high‑risk, enforce DNS‑level blocking of the domain and its resolved IP, monitor for any outbound connections to the host, and incorporate the indicator set (domain, IP, name servers, registrar, and TLS fingerprint) into threat‑intel feeds. Continuous re‑evaluation is advised, as future changes to the site’s content or hosting could modify the risk profile.