oauth-x[.]link

Analysis of oauth-x.link was conducted on July 23, 2026. The domain was registered on February 23, 2026 through the Unstoppable Domains registrar, which is unusual for a site that presents a page title referencing Unstoppable Domains itself. No SSL certificate is observed, and the site is currently taken offline, returning no HTTP response. DNS resolution points to IP 34.42.100.71, an address owned by Google LLC (ASN 396982) located in the United States.

The domain uses Google Cloud DNS nameservers ns-cloud-a1.googledomains.com, ns-cloud-a2.googledomains.com, and ns-cloud-a3.googledomains.com, indicating reliance on Google’s infrastructure for hosting. Threat intelligence feeds show that six of ninety‑three VirusTotal scanners flagged the domain, and three independent blocklists have added oauth-x.link to their deny lists. Additional defensive products, including PhishDestroy, MetaMask, and SEAL, have explicitly blocked the domain. The page title returned by the site, “oauth-x.link | Unstoppable Domains | Unstoppable Domains,” suggests an attempt to masquerade as an official Unstoppable Domains portal, potentially to harvest credentials or redirect users to malicious content.

Because the site is offline, active content cannot be examined, leaving the exact malicious payload unknown. However, the combination of recent registration, lack of TLS, association with a reputable registrar, and multiple detections strongly indicates a credential‑stealing campaign targeting users of Unstoppable Domains or related services. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the IP address or similar sub‑domains, and advise users to verify TLS certificates and URLs before entering authentication details. Threat‑intel teams should also consider adding the domain to internal watchlists and sharing the indicator with partner organizations to improve collective detection.