ltc1[.]agibogpt[.]com

This domain is flagged as an elevated-risk phishing site specifically targeting cryptocurrency users through a fake AgiBot wallet interface. Analysis indicates the domain was designed to harvest login credentials, seed phrases, or private keys under the guise of a legitimate crypto service, increasing the likelihood of financial theft from unsuspecting victims. Infrastructure analysis reveals the domain ltc1.agibogpt.com was registered on February 21, 2026, through GoDaddy.com, LLC, and resolves to the IP address 102.223.72.41. It is currently offline but was previously detected by 11 out of 95 security vendors on VirusTotal, including a listing on the PhishDestroy blocklist. The domain holds a Gridinsoft trust score of 0/100, further confirming its malicious nature. Technical indicators show the use of Nginx as the web server, along with HSTS and HTTP/3 protocols, which are often exploited to lend false credibility to phishing sites. Mitigation steps for this threat include blocking the domain and its associated IP (102.223.72.41) at the network level to prevent access. Organizations should update endpoint protection rules to flag any attempts to resolve or connect to this domain. Users who may have interacted with the site should immediately revoke any active sessions, rotate credentials for cryptocurrency wallets or exchanges, and monitor accounts for unauthorized transactions. Security teams are advised to review logs for connections to the domain or IP and conduct phishing awareness training emphasizing the risks of fake crypto wallet interfaces.