oauth-v2-consent[.]digital

This domain, oauth-v2-consent.digital, has been identified as a generic phishing site. The domain does not appear to be targeting a specific brand or using a known drainer kit. Analysis of the domain’s infrastructure and behavior suggests it was likely used to deceive users into providing sensitive information.

Infrastructure analysis reveals that the domain was registered through NameSilo, LLC on March 29, 2026. The domain resolves to the IP address 172.67.178.79 and employs technologies such as Cloudflare Browser Insights, Cloudflare, and HTTP/3. According to VirusTotal, 4 out of 95 security vendors have flagged this domain as malicious. Additionally, the domain appears on 3 security blocklists, indicating a higher level of suspicion and risk. The Google Safe Browsing (GSB) status is not provided, but the presence on multiple blocklists suggests it has been involved in malicious activities.

The current status of the domain is offline, and it is blocked by security tools such as MetaMask, PhishDestroy, and SEAL. Despite being taken offline, the domain poses a residual risk, as it may be reactivated or used in future phishing campaigns. Users are advised to remain vigilant and avoid clicking on links or entering personal information on unfamiliar or suspicious websites. Organizations should update their threat intelligence databases and ensure that their security systems are configured to block this domain and similar threats.