agentcity[.]fun

This domain, agentcity.fun, is currently flagged as an active credential harvesting phishing site. Analysis indicates it is designed to impersonate legitimate login portals, tricking users into submitting sensitive credentials such as usernames, passwords, and potentially multi-factor authentication codes. The domain remains operational and poses an elevated risk to individuals and organizations due to its deceptive nature and ongoing malicious activity. Infrastructure analysis reveals the domain was registered on December 26, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 172.67.144.33, hosted on Cloudflare’s network (AS13335). Security vendor assessments on VirusTotal show that 12 out of 95 engines have detected malicious activity associated with this domain. Additionally, the domain appears on one security blocklist, and its page title, 'Even geduld...' (Dutch for 'Please wait...'), suggests a loading or redirection mechanism commonly used in phishing campaigns to delay detection. No legitimate brand association has been confirmed, but the domain’s structure and behavior align with credential theft operations. Current status indicates the domain remains active and unremediated. Organizations and individuals are advised to block all connections to 172.67.144.33 and agentcity.fun at the network perimeter. Endpoint protection systems should be updated to include this domain and its associated IP in deny lists. Users who may have interacted with the domain should immediately reset credentials for any accounts accessed during the exposure window. Network logs should be reviewed for connections to the domain or IP, with particular attention to POST requests or unusual authentication attempts. Given the domain’s recent registration and Cloudflare hosting, further monitoring of newly created domains with similar patterns is recommended.