galaticothaikhongg[.]netlify[.]app

PhishDestroy identifies galaticothaikhongg.netlify.app as an active high-risk phishing domain hosting a cryptocurrency drainer kit designed to steal wallet credentials and funds. This fraudulent site impersonates a legitimate service to deceive users into connecting their wallets, triggering unauthorized transactions. The domain leverages Netlify’s hosting infrastructure to evade traditional detection mechanisms while distributing malicious JavaScript payloads capable of draining crypto assets without user consent. The threat actor behind this campaign employs social engineering tactics, including fake login prompts and wallet connection requests, to trick victims into authorizing transactions that transfer funds to attacker-controlled addresses. This domain was flagged by PhishDestroy with a high-risk classification due to its active exploitation in the wild. Technical indicators include a VirusTotal detection rate of 11/95 security vendors, a Netlify registration, and resolution to IP address 63.176.8.218. Google Safe Browsing has classified this domain under SOCIAL_ENGINEERING, and it remains unblocked by most major threat intelligence platforms. The domain’s SSL certificate, issued by DigiCert Inc, adds a false sense of legitimacy, further increasing the risk of successful deception. Given the lack of widespread blocking and the domain’s recent activity, the window for exposure remains significant. As of the latest assessment, galaticothaikhongg.netlify.app remains an active threat with no signs of takedown. Users are strongly advised to avoid interacting with this domain and report it immediately via PhishDestroy’s threat intelligence portal. The remaining risk is classified as high due to the domain’s evasion of standard detection mechanisms and its potential to cause irreversible financial loss. Immediate action, including network-level blocking and user awareness campaigns, is recommended to mitigate further exposure. PhishDestroy continues to monitor this domain and will update its threat intelligence feed as new developments arise.