ingreso[.]galihbonline[.]com

The domain ingreso.galihbonline.com was created on September 23, 2025 and is currently offline, returning an HTTP 410 status. DNS resolution points to the address 151.101.219.10, which belongs to AS54113 Fastly, Inc. and is geolocated to Argentina. Registration records show the domain was registered through Hosting Concepts B.V. d/b/a Registrar.eu. The authoritative nameservers are lily.ns.cloudflare.com and reese.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service.

No TLS certificate was observed for the host, confirming the absence of HTTPS protection. The page title returned by the server reads "Online Banking | Banco Galicia," while the campaign is classified as a banking phishing operation that impersonates WhatsApp, suggesting a hybrid social‑engineering lure that mixes financial and messaging brand cues. Detection metrics show that 14 of 95 security vendors on VirusTotal flagged the domain as malicious, and Google Safe Browsing lists it under social engineering. Additional reputation signals include a Gridinsoft trust score of 0 out of 100, a single entry on a public blocklist, and an explicit block by the PhishDestroy service.

These indicators collectively confirm that the infrastructure was actively used for credential harvesting targeting WhatsApp users under the pretense of a Banco Galicia banking portal. The precise content of the page was not captured, and the lack of SSL prevents verification of any embedded resources or redirects. Defenders should immediately block the domain and its resolving IP at perimeter and endpoint layers, add the host to internal blocklists, and monitor for any resurgence of the domain or related Fastly‑hosted IP ranges. Continuous watch of the registrar and nameserver configuration is advised to detect potential re‑registration attempts, and threat‑intel feeds should be updated with the observed indicators to improve detection of similar hybrid impersonation campaigns.