# PhishDestroy threat dossier — galaticothaikhongg.netlify.app ================================================================ Fetched: 2026-05-15 02:24:59 UTC Canonical: https://phishdestroy.io/domain/galaticothaikhongg.netlify.app/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 69/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 18/95 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, Emsisoft, Fortinet, G-Data, Google Safebrowsing, LevelBlue, Mimecast, Netcraft, OpenPhish, PREBYTES Google Safe Browsing: FLAGGED ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 63.176.8.218 Registrar: Netlify Nameservers: NS_NOT_FOUND Registered: 2026-05-15 Page title: Facebook HTTP response: 200 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-15 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-15 03:25:45 UTC (by PhishDestroy tracker) Last verified: 2026-05-15 05:15:32 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e2904-c71e-746a-98fe-040115114688/ Wayback Machine: https://web.archive.org/web/*/galaticothaikhongg.netlify.app crt.sh CT logs: https://crt.sh/?q=%25.galaticothaikhongg.netlify.app Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=galaticothaikhongg.netlify.app AlienVault OTX: https://otx.alienvault.com/indicator/domain/galaticothaikhongg.netlify.app URLhaus: https://urlhaus.abuse.ch/host/galaticothaikhongg.netlify.app/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-15 03:26:08 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies galaticothaikhongg.netlify.app as an active high-risk phishing domain hosting a cryptocurrency drainer kit designed to steal wallet credentials and funds. This fraudulent site impersonates a legitimate service to deceive users into connecting their wallets, triggering unauthorized transactions. The domain leverages Netlify’s hosting infrastructure to evade traditional detection mechanisms while distributing malicious JavaScript payloads capable of draining crypto assets without user consent. The threat actor behind this campaign employs social engineering tactics, including fake login prompts and wallet connection requests, to trick victims into authorizing transactions that transfer funds to attacker-controlled addresses. This domain was flagged by PhishDestroy with a high-risk classification due to its active exploitation in the wild. Technical indicators include a VirusTotal detection rate of 11/95 security vendors, a Netlify registration, and resolution to IP address 63.176.8.218. Google Safe Browsing has classified this domain under SOCIAL_ENGINEERING, and it remains unblocked by most major threat intelligence platforms. The domain’s SSL certificate, issued by DigiCert Inc, adds a false sense of legitimacy, further increasing the risk of successful deception. Given the lack of widespread blocking and the domain’s recent activity, the window for exposure remains significant. As of the latest assessment, galaticothaikhongg.netlify.app remains an active threat with no signs of takedown. Users are strongly advised to avoid interacting with this domain and report it immediately via PhishDestroy’s threat intelligence portal. The remaining risk is classified as high due to the domain’s evasion of standard detection mechanisms and its potential to cause irreversible financial loss. Immediate action, including network-level blocking and user awareness campaigns, is recommended to mitigate further exposure. PhishDestroy continues to monitor this domain and will update its threat intelligence feed as new developments arise. ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/galaticothaikhongg.netlify.app/ JSON API: https://api.destroy.tools/v1/check?domain=galaticothaikhongg.netlify.app Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 149,568 domains (31,903 alive under monitoring, 116,920 confirmed takedowns/dead). Site: https://phishdestroy.io