galvica[.]cfd

The domain galvica.cfd has been confirmed as a fake login phishing site. Analysis indicates that the site is impersonating a legitimate service, likely a messaging platform, to trick users into divulging sensitive information such as login credentials. There is no evidence of a specific drainer kit being utilized, but the domain's infrastructure and behavior suggest a targeted phishing campaign aimed at compromising user accounts.

Technical indicators for galvica.cfd include a VirusTotal detection score of 0/95, indicating that the domain has not yet been flagged by antivirus engines or security products. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 172.67.188.239. The domain was created on June 26, 2026. As of the latest assessment, the site remains active and is not listed in the Google Safe Browsing (GSB) database or on any known blocklists. This suggests that the campaign is relatively new and may be under active development.

The current status of galvica.cfd is active, and further investigation is recommended to assess the full scope of the threat. Organizations and individuals are advised to implement robust security measures, including user education on recognizing phishing attempts, and to avoid interacting with the domain. The domain's low detection count and active status pose a significant risk, as users may be unaware of the threat and more likely to fall victim to the phishing campaign. Immediate steps should include reporting the domain to relevant authorities and security platforms to enhance detection and mitigate potential damage.