gal-0x000[.]xyz

Analysis of gal-0x000.xyz shows a newly registered domain created on February 21, 2026 that resolves to the IP address 172.67.161.107, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The domain is currently listed as offline, indicating that any hosting service has been taken down or the site is no longer reachable. Despite its offline status, multiple security services have taken action: PhishDestroy and ScamSniffer have blocked the domain, and it appears on two external blocklists, suggesting that it was previously identified as malicious.

VirusTotal scans report that nine out of ninety‑three security vendors flagged the domain, reinforcing the suspicion of malicious intent. The SSL certificate associated with the domain is identified as "WE1," confirming that HTTPS was enabled at some point, a common characteristic of credential‑harvesting sites. No public page title or content analysis is available, and the specific phishing lure or targeted brand has not been disclosed in the intelligence set.

The combination of recent registration, Cloudflare hosting, blocklist inclusion, and multi‑vendor detection points to a high likelihood of phishing activity. Defenders should continue to block the domain at perimeter controls, monitor DNS queries for the resolved IP, and consider adding the domain to internal blacklists. Ongoing threat‑intel feeds should be consulted for any re‑appearance or related indicators, and any compromised credentials associated with the domain should be investigated and rotated where applicable.