galaxydesktop[.]com

Analysis of galaxydesktop.com indicates a high‑risk brand‑impersonation campaign targeting Bitcoin users. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is served by the authoritative name servers ns3.my-ndns.com and ns4.my-ndns.com. Hosting resolves to IP address 216.198.79.1, an Amazon.com, Inc. (AS16509) endpoint located in the United States. No TLS certificate is present, meaning the site was delivered over plain HTTP only. Google Safe Browsing classifies the URL as social engineering, and the page title returned from the live endpoint—"Galaxy Desktop App - Bitcoin Under Your Control"—explicitly references Bitcoin, confirming the impersonation claim.

VirusTotal scanned the domain and recorded 15 detections out of 93 security vendors, reflecting a moderate consensus among scanners that the site is malicious. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy service. Current operational status is offline, suggesting the actors have taken the site down, but the infrastructure artifacts remain observable.

Defenders should continue to block the IP 216.198.79.1 and the domain galaxydesktop.com at DNS and proxy layers, add the domain to internal phishing‑alert lists, and monitor other domains registered by the same registrar or using the same name servers for similar patterns. Given the Amazon hosting, threat‑hunters may also query the ASN for other suspicious activity tied to the same CIDR blocks. Continuous re‑evaluation of the domain’s status on blocklists and safe‑browsing services is recommended, as the actors could reactivate the site or spawn new clones employing the same branding approach.