hackgalaxy[.]in

The domain hackgalaxy.in remains active as of the report date (22 July 2026). It was registered through GoDaddy on 15 July 2025 and is hosted on a GoDaddy‑owned server in Singapore (IP 118.139.183.37). The site presents a TLS certificate issued by Let’s Encrypt (YR1) and resolves via the authoritative name servers ns21.domaincontrol.com and ns22.domaincontrol.com. An Apache HTTP Server responds with HTTP 200, and the page title retrieved is “Best Ethical Hacking Course in Mumbai with Placement (2026)”, suggesting a credential‑harvesting lure aimed at individuals seeking hacking education.

VirusTotal records indicate that six of ninety‑one security vendors flag the domain, and it appears on one external blocklist. The phishing‑specific blocklist PhishDestroy also lists the domain. Mail Exchange records point to mail.hackgalaxy.in, confirming a functional MX configuration. The observable indicators confirm that the domain is being used in a generic phishing campaign of high risk.

What remains unknown is the full payload delivered after the initial landing page, any credential‑capture forms, and whether additional sub‑domains are leveraged. Defenders should add the IP address 118.139.183.37 and the hostname hackgalaxy.in to network blocklists, monitor DNS queries for the associated MX host, and enforce strict TLS inspection to detect any downstream payload. Threat‑intel feeds should be updated with the domain, its registrar, and the six vendor detections to improve correlation. Continuous re‑assessment is advised, as the infrastructure could be repurposed or expanded.