galxe-kh[.]pro

Analysis of the domain galxe-kh.pro indicates that it was actively used for a generic phishing campaign before being taken offline. The domain resolves to the IPv4 address 89.163.155.33, which is allocated to WIIT AG in Germany (ASN 24961). Geolocation data confirms the host resides in Germany. No TLS certificate is present, meaning any traffic to the site would have been unencrypted, a common trait of low‑cost phishing infrastructure.

The registration details show the domain was created through the DE‑MYLOC‑DUS‑20060217 registrar, reinforcing the German hosting footprint. Reputation services label the site as highly untrustworthy: Scamadviser assigns a 1/100 score, Gridinsoft a 0/100 score, and the domain appears on two security blocklists. Independent scanning on VirusTotal recorded seven detections out of ninety‑five engines, confirming that at least some AV products identified malicious content associated with the domain. Additional threat‑intel sources corroborate the finding: an AlienVault OTX pulse references the domain, and commercial blocklists PhishDestroy and ScamSniffer have both flagged it.

Nameserver records point to ns7.privatedns.vip and ns8.privatedns.vip, which are often used by transient malicious actors. The current offline status prevents live verification of page content, page title, or any brand targeting, leaving those aspects uncertain. Defenders should continue to block any resolution to 89.163.155.33, monitor the associated nameservers for reuse, and ensure that email filters reference the observed blocklist entries. Given the low trust scores, lack of encryption, and multiple detections, the domain should be treated as a confirmed phishing source and remain on deny lists until it is demonstrably clean.