bagssweep[.]fun

Analysis indicates that bagssweep.fun is an active phishing domain targeting users with a fraudulent portfolio automation service. The domain was registered on March 18, 2026, through NAMECHEAP INC and currently resolves to the IP address 69.46.46.72. The page title, 'Bags Sweep - Portfolio on Autopilot,' suggests an attempt to deceive users into engaging with a fake financial or investment platform. Infrastructure analysis reveals the use of Node.js, Express, and Unpkg, alongside cart functionality, which may facilitate fraudulent transactions or data collection. The domain appears on two security blocklists and has been flagged in 14 threat intelligence pulses on AlienVault OTX. Five security vendors on VirusTotal have detected malicious activity associated with this domain. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. The domain's Gridinsoft trust score of 0/100 further supports its classification as high-risk. Defenders should treat this domain as actively malicious. Blocking the domain and its associated IP (69.46.46.72) at the network level is recommended. Additional monitoring for related infrastructure, such as domains registered through the same registrar or resolving to the same IP, may help identify further threats. The exact content and functionality of the site remain unanalyzed, but the available indicators confirm its use in phishing operations.