awgtm[.]com

The domain awgtm.com has been classified as a high‑risk generic_phishing operation and remains active. The zone was registered on March 28, 2026 through Gname 129 Inc, and authoritative name servers dm1.longmingdns.com and dm2.longmingdns.com resolve the domain to the IPv4 address 198.252.106.116, which is hosted by Hawk Host Inc in the United States. The site presents a valid TLS certificate issued by Let’s Encrypt and advertises a modern web stack that includes PHP, Nginx, HSTS, and HTTP/3 support.

Intelligence feeds have recorded the domain in two AlienVault OTX pulses, and it currently appears on three external blocklists. Defensive services such as PhishDestroy, MetaMask, and SEAL have already blocked the host, indicating that the infrastructure is recognized by multiple mitigation platforms. VirusTotal has not reported any detections across 95 scanners, which reflects a lack of public malware signatures rather than an indication of benign intent.

While the technical footprint confirms the presence of a phishing‑oriented site, the specific payload or credential‑harvesting page has not been publicly disclosed. No samples have been submitted to sandbox environments, and the absence of detections on VirusTotal leaves the exact content of the hosted pages uncertain. Consequently, analysts should treat the domain as malicious despite the current lack of forensic artifacts.

Defenders are advised to add awgtm.com and its resolved IP address 198.252.106.116 to network deny lists, enforce DNS filtering, and monitor for any anomalous traffic targeting the host. Continuous re‑evaluation of blocklist status is recommended, as the domain may evolve its infrastructure or deploy additional malicious assets. Organizations should also consider employing sinkholing techniques for the associated IP range to capture potential victim interactions and to aid in attribution efforts.