TP: If you're able to affirm the OAuth application is sent from an unknown resource, and redirects to your suspicious URL, then a true favourable is indicated. Verify whether or not the application is crucial for your Firm before thinking about any containment actions. Deactivate the