ltc4[.]agiboto[.]com

This domain is flagged as an elevated-risk phishing site specializing in cryptocurrency credential harvesting. Analysis indicates the domain presents a fraudulent interface mimicking AgiBot, a legitimate cryptocurrency service, to deceive users into submitting wallet credentials, private keys, or two-factor authentication codes. The threat type aligns with targeted financial fraud, where stolen credentials are used to drain digital asset accounts or conduct unauthorized transactions. Infrastructure analysis reveals the domain ltc4.agiboto.com was registered on February 21, 2026, through GoDaddy.com, LLC, and currently resolves to the IP address 102.223.72.41. The site is detected on one security blocklist and has been flagged by 13 out of 95 security vendors on VirusTotal, indicating moderate but consistent detection. A Gridinsoft trust score of 0/100 further corroborates its malicious nature. Technical indicators include the use of Nginx as a web server, HTTP/3 for transport, and HTTP Strict Transport Security (HSTS) headers, which are often exploited to lend an air of legitimacy to phishing pages. Mitigation requires immediate action from network defenders and end users. Organizations should block the domain and its resolving IP (102.223.72.41) at the perimeter firewall and DNS level to prevent access. End users who may have interacted with the site should assume credential compromise and rotate passwords, private keys, and any associated authentication tokens for cryptocurrency wallets or exchanges. Browser-based security policies should enforce strict HSTS validation to prevent downgrade attacks, and users should verify domain authenticity before entering sensitive information. Security teams are advised to monitor for outbound connections to 102.223.72.41 and correlate logs with known phishing indicators to identify compromised accounts.