galaxy-plant-inc[.]biz

Analysis of galaxy-plant-inc.biz, created on April 02, 2026 and registered through Global Domain Group LLC, shows a high‑risk generic phishing profile. The domain resolves to the IPv4 address 66.70.148.17 and is served by the authoritative name servers ns5.ddoscure.com, ns6.ddoscure.com, protected3.ddoscure.com, and protected4.ddoscure.co, indicating infrastructure shared with other potentially malicious sites hosted by the same provider. VirusTotal scans have recorded four detections out of ninety‑one security vendors, confirming that a minority of scanners have identified malicious characteristics.

The domain appears on a single public blocklist and is already blocked by the PhishDestroy service, reinforcing the view that it is being actively used for phishing. Current monitoring indicates the domain remains active as of the report date, July 27, 2026, and no public evidence has been disclosed regarding SSL certificate details, HTTP response codes, page title, or additional threat intelligence feeds. Defenders should treat any traffic to galaxy-plant-inc.biz as hostile, enforce network‑level blocking using the known IP address and observed name servers, and include the domain in endpoint and email filtering policies.

Continuous observation of the associated name servers and the hosting provider is advisable, as further malicious payloads may be deployed from the same infrastructure. The lack of broader detection or additional blocklist listings suggests limited exposure, but the confirmed phishing classification warrants immediate mitigation to prevent credential harvesting or related compromise attempts.