galixwallet[.]co[.]com

This domain, galixwallet.co.com, is assessed as a high-risk crypto seed drainer phishing site. Infrastructure analysis reveals it was registered via Moniker Online Services LLC on August 16, 1997, an unusually early date that may indicate domain recycling or falsified registration details. The domain currently resolves to IP 212.118.38.157, hosted on AS216071 (SERVERS TECH FZCO) in the Netherlands, a network frequently associated with malicious activity. Nameservers are split between regway.com and nic.co.com, a pattern often seen in bulletproof or low-reputation hosting setups. The site presents itself under the page title 'Holdexer - Secure Hardware Wallet for Cryptocurrency', suggesting a targeted impersonation of hardware wallet services to harvest seed phrases.

This aligns with the classified scam type: Wallet/Seed Phishing, specifically employing a Seed Phrase Phishing kit. No direct brand impersonation is confirmed beyond the page title, and the exact visual or functional mimicry is not analysed. Detection evidence is substantial: the domain appears on four security blocklists and is actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, indicating cross-industry recognition of the threat. Gridinsoft and Scamadviser both assign trust scores of 1 or lower out of 100, reinforcing the high-risk classification. The SSL certificate, issued by DigiCert Inc (Global G2 TLS RSA SHA256 2020 CA1), is valid but does not mitigate the malicious intent, as phishing sites commonly use legitimate certificates to appear trustworthy.

As of July 25, 2026, the domain is offline with an HTTP 404 status, though this does not confirm permanent takedown. Defenders should treat all prior resolutions of this domain as compromised infrastructure. Recommended actions include blocking the domain and IP at perimeter controls, monitoring for re-emergence under the same or similar names, and alerting users who may have interacted with the site before it was taken offline.