galabetin[.]top

This domain, galabetin.top, is flagged as a generic phishing resource impersonating a legitimate hosting provider under the guise of SRNHOST. Analysis indicates the site presents itself as a hosting sales platform, likely targeting users seeking web hosting services to harvest credentials or financial information. No specific drainer kit signatures have been confirmed, but the infrastructure aligns with broader phishing campaign patterns observed in similar impersonation schemes. Infrastructure analysis reveals the domain was registered on June 15, 2026, through DYNADOT LLC, an uncommon creation date that may indicate an attempt to evade temporal detection heuristics. It resolves to the IP address 104.21.18.64, a Cloudflare-protected endpoint utilizing HTTP/3 protocols. The domain is currently detected by 19 out of 95 security vendors on VirusTotal, with a single appearance on a public blocklist and one threat intelligence pulse in AlienVault OTX. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to malicious domains. No Google Safe Browsing (GSB) flags are currently recorded. The domain remains active and poses an elevated risk due to its operational status and low detection coverage. Response actions by security vendors are limited, with only one known blocklist (PhishDestroy) currently mitigating exposure. The use of Cloudflare infrastructure complicates takedown efforts and obscures origin server details. Users are advised to treat this domain as malicious and avoid interaction. Organizations should update internal blocklists with the domain and IP address, monitor for related indicators of compromise, and validate any hosting-related communications through verified channels only.