galaxydigital[.]prfts[.]cfd

PhishDestroy identifies active phishing activity hosted at galaxydigital.prfts.cfd that specifically impersonates the legitimate investment platform Galaxydigital to harvest funds and credentials under the guise of ‘safe investments.’ The domain is classified as a generic phishing campaign, currently under investigation and marked as active since April 03, 2026. This threat poses a direct risk to users seeking genuine investment opportunities by leveraging deceptive branding and false promises of security. This domain was flagged with VirusTotal showing 0 detections out of 95 engines as of the latest scan, indicating it remains undetected by most antivirus platforms. It resolves to the IP address 102.212.247.99 and was registered through NameSilo, LLC. The page title displayed—“Galaxydigital – Safe investment with Galaxydigital”—mirrors legitimate branding to deceive visitors. The domain was created on April 03, 2026, and currently shows no presence on public blocklists or in threat intelligence feeds, suggesting a recently launched campaign with low detection coverage. To mitigate exposure, users should avoid accessing galaxydigital.prfts.cfd entirely and verify any investment-related URLs directly through the official Galaxydigital website or trusted financial directories. Corporate and individual investors are advised to block the IP 102.212.247.99 at the network perimeter and update browser-based blocklists to include this domain. Security teams should monitor for similar domains registered through NameSilo with recent creation dates and keywords like ‘investment’ or ‘galaxy’ in subdomains or paths. Immediate reporting of this domain to hosting providers and domain registrars may accelerate takedown efforts. Exercise heightened caution with any unsolicited investment offers, especially those promoting guaranteed returns or urgent actions.