oauth[.]dev[.]autobricksai[.]run

The domain oauth.dev.autobricksai.run is presently active and resolves to the IPv4 address 167.254.241.194. Passive DNS queries show that the domain lacks publicly resolvable nameserver records, which can indicate a deliberately opaque hosting configuration often used by malicious operators to hinder attribution. VirusTotal has recorded detections from seven of ninety‑one scanned security vendors, confirming that the domain is recognized by multiple independent sources as suspicious. The threat classification has been assigned as generic_phishing with a high risk rating, suggesting that the site is being used to harvest credentials or other sensitive information. No additional infrastructure details, such as ASN or hosting provider, are disclosed in the available intelligence, and the content of the site has not been publicly analyzed, leaving the exact phishing vector unknown. Defenders should block network traffic to 167.254.241.194 and add oauth.dev.autobricksai.run to URL filtering lists. Continuous monitoring of DNS resolutions and any future VirusTotal updates is recommended to detect changes in the domain’s behavior.