ltc5[.]agiboby[.]com

The domain ltc5.agiboby.com has been identified as a phishing endpoint specifically designed to impersonate MetaMask, a widely used cryptocurrency wallet service. This domain operates under the guise of a legitimate wallet interface to harvest sensitive credentials, including private keys and recovery phrases, from unsuspecting users. Analysis confirms the domain is currently offline, though its infrastructure remains a documented threat vector in ongoing phishing campaigns. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on February 21, 2026, and resolves to the IP address 102.223.72.41. Detection metrics indicate elevated risk levels, with 15 of 95 security vendors on VirusTotal flagging the domain as malicious. The domain holds a Gridinsoft trust score of 0 out of 100, further corroborating its classification as a high-risk entity. Additionally, the domain appears on one security blocklist and is explicitly blocked by PhishDestroy. Technical indicators include the use of Vue.js, Nginx, HTTP/3, and HTTP Strict Transport Security (HSTS), suggesting an attempt to mimic legitimate web application security practices while concealing malicious intent. Current status confirms the domain is offline, though residual risk persists due to its documented association with credential theft operations. Organizations and end-users are advised to treat any prior interaction with this domain as a potential security incident. Immediate actions should include revoking access to any credentials entered on the site, monitoring for unauthorized transactions, and implementing network-level blocks for the IP address 102.223.72.41. Security teams are further encouraged to review logs for connections to this domain and its associated IP, as well as to update detection rules to include ltc5.agiboby.com in phishing and brand impersonation filters.