oauth[.]evergreenfin[.]ltd

The domain oauth.evergreenfin.ltd was observed on 2026-08-04 as part of an ongoing generic phishing investigation. The domain is currently listed on a single security blocklist and has been added to the PhishDestroy blocklist, indicating that at least one reputable anti‑phishing feed is actively filtering traffic to it. VirusTotal records show that the domain was submitted for analysis and examined by 91 scanning engines; none of the engines produced a detection at the time of the scan.

The absence of a detection does not imply benign intent, and the scan result should be interpreted as a single data point within a broader risk assessment. Infrastructure details such as registrar information, hosting IP address, autonomous system number, TLS certificate properties, HTTP response codes, and Safe Browsing status have not been disclosed in the available intelligence. Likewise, no page title or brand attribution has been published, so the specific lure or credential‑capture technique employed by the site remains unknown.

Given the limited but concrete indicators—blocklist inclusion and PhishDestroy tagging—defenders should treat oauth.evergreenfin.ltd as a potentially malicious host. Recommended actions include adding the domain to internal deny lists, monitoring DNS queries for resolution attempts, and employing URL filtering solutions that reference the PhishDestroy feed. Continuous re‑evaluation is advised, as additional telemetry (e.g., TLS fingerprint, hosting changes, or new vendor detections) may emerge and alter the threat posture.