# PhishDestroy threat dossier — spiralgalaxy.net ================================================================ Fetched: 2026-07-30 13:52:21 UTC Canonical: https://phishdestroy.io/domain/spiralgalaxy.net/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 3/91 security vendors flagged this domain Flagging vendors: CRDF, Gridinsoft, SOCRadar AlienVault OTX: 4 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 87.85.108.83 (DE, Düsseldorf) ASN: AS62468 VpsQuan L.L.C. Hosting org: GTT - EMEA Ltd Registrar: Dominet (HK) Limited Nameservers: ["ns1.domainnamedns.com", "ns2.domainnamedns.com"] Page title: 银河娱乐城-银河（GALAXY）官方网站 HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-09-03 Status: INVALID chain Fingerprint: 4681d90b2289cabc289564cfe431111a15fccdf08d463b65402f8839fd43a154 Subject Alternative Names (related infrastructure — often same operator): - 0898xy.com - 1010xy.com - 18xyc.com - 511xy.cc - allinonegalaxy.com - chibigalaxy.com - galaxy53.com - galaxy6623.top - galaxybrains.net - galaxyconst.com - galaxydownloads.com - galaxygates.net - galaxypcs.net - galaxypedals.com - galaxysolar.top ... +83 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-28 09:23:09 UTC (by PhishDestroy tracker) Last verified: 2026-07-30 12:38:35 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-28 09:25:43 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] spiralgalaxy.net Safety Check — Phishing Detected Analysis of spiralgalaxy.net shows a domain that is currently active and serving HTTP content with a 200 response code. The domain was registered through Dominet (HK) Limited, indicating a Hong Kong‑based registrar. Infrastructure inspection reveals two authoritative name servers, ns1.domainnamedns.com and ns2.domainnamedns.com, which are publicly resolvable but provide no additional context about hosting location or ASN. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy feed, confirming that at least one anti‑phishing service has identified it as malicious. VirusTotal reports that the domain was scanned by 91 commercial and open‑source scanners; none of the engines returned a positive detection at the time of the scan. While the absence of detections does not constitute proof of legitimacy, it does suggest that automated signatures have not yet been updated to flag this particular host. No SSL/TLS certificate information, page title, or Safe Browsing verdict is available from the supplied data, and no references to OTX or other threat‑intel platforms have been recorded. Consequently, the observable evidence points to a classic phishing infrastructure that is operational and has evaded signature‑based detection. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the listed name servers, and consider adding the host to internal blocklists. Ongoing telemetry collection is recommended to capture any future changes in detection status or the emergence of additional indicators such as malicious payload hashes or phishing page snapshots. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: a3e0f60e54eb824863586b9a6902bdd3 TLS cert SHA-256: 4681d90b2289cabc289564cfe431111a15fccdf08d463b65402f8839fd43a154 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/spiralgalaxy.net/ JSON API: https://api.destroy.tools/v1/check?domain=spiralgalaxy.net Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 195,845 domains (83,543 alive under monitoring, 110,042 confirmed takedowns/dead). Site: https://phishdestroy.io