agi7788[.]vip

Analysis of agi7788.vip indicates a high-risk phishing domain active as of July 12, 2026. The domain resolves to 172.67.167.90, an IP address geolocated to Cloudflare infrastructure in Canada, and is configured with Cloudflare nameservers (liv.ns.cloudflare.com, carl.ns.cloudflare.com). The domain was registered on April 22, 2026, through Gname.com Pte. Ltd. and currently returns an HTTP 302 status code, suggesting a redirect mechanism commonly used in phishing campaigns to evade detection or route victims to malicious endpoints. The page title, 'Loading.', provides no explicit indication of the target brand or scam type, and no additional content analysis has been conducted. Security vendors have flagged the domain, with 6 out of 94 engines on VirusTotal detecting it as malicious. It appears on two security blocklists and is referenced in one AlienVault OTX threat intelligence pulse. The domain is also blocked by PhishDestroy and ScamSniffer, further corroborating its malicious classification. Infrastructure analysis reveals the use of a Let's Encrypt SSL certificate (serial number E7), which is consistent with both legitimate and malicious domains leveraging free certificates for encryption. The domain's creation date (81 days prior to this report) does not deviate from typical phishing domain lifecycles, which often operate for short periods before being taken down or replaced. Defenders should treat this domain as actively malicious. Recommended actions include blocking resolution at the DNS level, monitoring for connections to the associated IP (172.67.167.90), and investigating any internal systems that have interacted with it. Given the 302 redirect behavior, downstream domains or IPs in the redirect chain should also be scrutinized for additional indicators of compromise. No specific brand or scam category has been confirmed at this time, limiting targeted mitigation advice beyond generic phishing defenses.