ag-rewards[.]xyz

The domain ag-rewards.xyz was registered through Dynadot Inc on 11 June 2026 and is currently resolving to the IPv4 address 138.124.79.155. Since its creation the domain has been listed on three independent security blocklists and is actively flagged by Google Safe Browsing for social engineering. Additional filtering services, including PhishDestroy, MetaMask and SEAL, have also added the domain to their deny lists, indicating that multiple threat‑intelligence feeds consider it malicious. VirusTotal analysis shows that 12 of 91 scanned security vendors have generated detections against the domain, reinforcing the high‑risk classification.

The operational status is reported as active, and the risk level is assigned as high. Available telemetry does not include public SSL certificate details, HTTP response codes, or page‑title metadata, so the exact content served by the site remains unknown. Likewise, no information on the underlying phishing kit, targeted brand, or victim interaction flow has been disclosed. The lack of visible page‑level indicators limits the ability to confirm whether the site is currently delivering credential‑stealing forms, malware payloads, or other exploit techniques.

Defenders should treat ag-rewards.xyz as a confirmed malicious indicator. Immediate actions include adding the domain to DNS‑based block lists, enforcing URL filtering on web proxies, and updating endpoint web‑control policies to deny connections to the associated IP address. Continuous monitoring of DNS query logs for look‑ups to 138.124.79.155 is advised, as is periodic re‑scanning of the domain on VirusTotal or similar sandboxes to capture any evolution of the payload. Given the recent registration date, the infrastructure may be short‑lived; rapid sink‑holing or takedown requests to the registrar could disrupt the campaign if operational details become available.