bagworkoor[.]lat

bagworkoor.lat is identified as an active phishing domain with a high-risk status, appearing on four different security blocklists. It has been flagged by 15 out of 95 security vendors on VirusTotal, indicating significant malicious activity associated with this domain. The domain was registered on March 16, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to IP address 172.67.184.151. The infrastructure behind this domain utilizes technologies such as Cloudflare and HTTP/3, which are commonly employed to enhance performance and security, but can also be exploited by malicious actors to obscure their activities. The presence of Cart Functionality suggests the possibility of fraudulent transactions being facilitated through this domain.

The page title "Un instant…" indicates that the domain may be targeting users in a French-speaking demographic, which could be part of a broader strategy to lure victims into a phishing scheme. Analysis from AlienVault OTX reveals that this domain has been included in 23 threat intelligence pulses, underscoring its relevance in ongoing threat detection efforts. The domain's trust score from Gridinsoft is notably low at 0 out of 100, further confirming its malicious intent.

This domain is actively blocked by security measures from entities such as SEAL, MetaMask, PhishDestroy, and BLP-Malware. Organizations and individuals should remain vigilant against potential phishing attempts associated with bagworkoor.lat. It is advisable to educate users about recognizing phishing attempts and to implement robust email filtering solutions to prevent potential interactions with this domain. Continuous monitoring of threat intelligence feeds is recommended to remain informed about the evolving tactics employed by threat actors associated with this domain.