ltc2[.]agiboto[.]com

This domain, ltc2.agiboto.com, is identified as a phishing infrastructure impersonating AgiBot, a known automation or bot-related service. Analysis confirms it as a generic_phishing threat, currently marked offline. The domain was actively used to deceive users into submitting sensitive information, likely through cloned interfaces or fraudulent login portals. Infrastructure analysis reveals the domain was flagged by 13 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It resolves to the IP address 102.223.72.41 and was registered through GoDaddy.com, LLC on February 21, 2026, suggesting a recently established malicious operation. The domain appears on one security blocklist, and its Gridinsoft trust score is 0 out of 100, reinforcing its high-risk classification. Detected technologies include Nginx as the web server, HSTS for forced HTTPS connections, and HTTP/3 for enhanced performance, which may have been leveraged to evade basic security filters. Current status indicates the domain has been taken offline, reducing immediate exposure. However, the infrastructure may resurface under a different name or IP. Organizations are advised to block the domain and its associated IP (102.223.72.41) at the perimeter level. Security teams should monitor for related indicators, such as the unique seed cecf69, and update detection rules to identify similar phishing attempts targeting automation or bot-related services. End-users should verify the authenticity of any AgiBot-related communications and report suspicious URLs to their security providers.