ag-token[.]xyz

Analysis of the domain ag-token.xyz, first observed on June 10, 2026, indicates active malicious use consistent with generic phishing. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on Cloudflare infrastructure, as evidenced by the nameservers celeste.ns.cloudflare.com and junade.ns.cloudflare.com and the presence of HTTP/3 support. DNS resolution points to IP address 188.114.96.3, which is geolocated to Canada and belongs to Cloudflare, Inc. The site serves a TLS certificate issued by Google Trust Services, providing a seemingly legitimate HTTPS connection that may increase victim trust. Malware and URL reputation services have flagged the domain; four of ninety‑five VirusTotal scanners reported it as malicious, and it appears on a single public blocklist. The phishing indicator is corroborated by inclusion in the PhishDestroy blocklist, confirming that at least one dedicated anti‑phishing service has taken remediation action. No additional intelligence such as page titles, brand impersonation, or specific payload details is currently available, limiting the depth of behavioral insight. Defenders should block network traffic to 188.114.96.3, add ag-token.xyz to local and upstream DNS deny lists, and monitor for related Cloudflare‑hosted domains that share the same nameserver set. Continuous re‑evaluation is recommended as further threat intelligence, such as additional vendor detections or content analysis, becomes available.