potetracking[.]onelink[.]me

The domain potetracking.onelink.me is currently flagged as an active brand‑impersonation site. According to the latest intelligence dated July 12 2026, the domain is under investigation with a risk level of under_investigation. It is associated with a banking‑phishing campaign that targets the brand “base” and remains operational.

Registration data show the domain was created on February 21 2026 and was registered through the OneLink (Branch) service. DNS resolution points to the IP address 104.20.19.108, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents an SSL certificate rated E1 and returns an HTTP 403 status code on access attempts. Infrastructure reputation is poor, with a Gridinsoft trust score of 0 out of 100 and inclusion on a single security blocklist. PhishDestroy has already blocked the domain.

The page title retrieved from the site is “List of Best CS2 Skins in 2023: Rated,” which does not directly reference the advertised banking‑phishing activity but indicates a content‑spoofing technique. The campaign is classified as banking phishing and explicitly impersonates the brand “base.” No detections were reported on VirusTotal (0 out of 95 engines), but the absence of alerts does not confirm legitimacy. The limited public evidence means the exact phishing landing page and credential‑capture mechanisms remain unknown.

Defenders should add potetracking.onelink.me to blocklists and enforce outbound filtering for any traffic to the associated IP address. Monitoring for DNS queries to the domain and for HTTP 403 responses can help identify compromised clients. Because the infrastructure relies on Cloudflare, sinkholing the IP may affect unrelated services; therefore, endpoint detection and response rules that flag attempts to contact the domain are recommended. Ongoing analysis should focus on capturing the full page payload and any redirects to validate the phishing workflow.