agvatatili[.]com

The domain agvatatili.com is currently classified as a high‑risk generic phishing infrastructure and remains active as of 12 July 2026. It first appeared in public records on 26 February 2026 and has since been listed on three security blocklists. The domain’s trust score from independent analysis is 0 out of 100, reinforcing the suspicion of malicious intent.

Infrastructure analysis shows the domain resolves to the IPv4 address 188.132.240.194, which is announced by AS216146 (NESNET INTERNET HIZMETLERI TICARET ANONIM SIRKETI) in Turkey. The authoritative nameservers are cn.apiname.com, uk.apiname.com, ns1.novasishost.com, and ns2.novasishost.com, indicating a multi‑regional DNS configuration. Hosting appears to be a Windows Server environment running Plesk with Microsoft ASP.NET on IIS, and the site presents a valid Let’s Encrypt R12 certificate. Registration was performed through Atak Domain.

Detection telemetry confirms the domain is blocked by multiple threat‑mitigation services, including PhishDestroy, MetaMask, and SEAL. VirusTotal reports a single positive detection out of 95 scanned security vendors. An HTTP request to the site returns a 200 status code and the page title "Domain Default page," but no additional content has been publicly disclosed for further analysis. The limited visible surface suggests the site may be used primarily as a landing point for credential‑stealing campaigns.

Defenders should prioritize adding agvatatili.com to network deny lists and ensure DNS resolvers are configured to block queries to the associated IP address and nameservers. Continuous monitoring of traffic to the identified IP and rapid updates to intrusion‑prevention signatures are recommended. Organizations that observe outbound connections to this domain should investigate potential credential exposure and consider incident response actions, including credential rotation and user awareness reinforcement.