consent-oauth-v2[.]info

This domain is flagged as an active OAuth credential phishing threat targeting authentication tokens and user credentials. Analysis indicates the infrastructure is designed to deceive users into granting access to sensitive accounts by impersonating legitimate OAuth consent flows, as evidenced by the page title www.insidelvmh.com and the use of cloud-based hosting services. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain resolves to IP address 188.114.96.3 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 17, 2026. Despite zero detections in VirusTotal (0/95), it appears on two security blocklists and has a Gridinsoft trust score of 0/100. The domain employs Let's Encrypt SSL certificates and leverages technologies including Prismic, Google Cloud, OneTrust, HSTS, Google Tag Manager, Google Cloud Trace, Facebook Pixel, and Akamai for content delivery and tracking. Mitigation requires immediate action from security teams and end-users. Network administrators should block the domain and its resolving IP (188.114.96.3) at the perimeter, while monitoring for internal connections to the address. End-users should be educated on recognizing OAuth phishing attempts, particularly those mimicking corporate login pages. Security teams must invalidate any credentials potentially exposed through this domain and implement multi-factor authentication to prevent unauthorized access. Given the domain's current offline status, continuous monitoring for re-emergence is critical, as phishing infrastructure often resurfaces under new domains or IPs.