gala-event[.]app

On 22 July 2026, the domain gala-event.app was identified as a malicious site targeting users interested in Ethereum. The site advertised a $GALA Token Airdrop, as reflected in the page title “$GALA Token Airdrop - Gala”. Technical analysis shows the domain resolves to the IP address 91.202.233.233, which is registered to an Autonomous System (AS200593) operated by PROSPERO OOO in Russia. The SSL certificate presented is classified as R10, and the Gridinsoft trust score is 0 out of 100, indicating a lack of trustworthiness.

VirusTotal reports that five of ninety‑three scanning engines flagged the domain, confirming the presence of malicious components. Five independent blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—have already added the domain, and it appears on a total of five security blocklists. The site is associated with a known “Airdrop Scam” phishing kit, and the overall scam type is recorded as a crypto scam. The domain was registered on 21 February 2026 and is currently listed as offline, suggesting the operators have taken the site down, either voluntarily or as a result of takedown actions.

While the page title and kit provide clear evidence of a cryptocurrency‑related deception, the exact content of the landing page has not been captured, leaving the specific user‑interaction flow uncertain. Defenders should block the domain and the associated IP address at the network perimeter, update URL filtering rules to include the identified blocklist entries, and monitor for any new domains resolving to the same IP or ASN. Continuous re‑scanning with multi‑vendor services is advised to detect any re‑appearance, and incident response teams should treat any credentials or wallet information entered on this site as compromised.