i[.]gal

Analysis of i.gal (registered 14 Oct 2016) shows the domain is actively serving web content (HTTP 200) and is secured with a valid Let's Encrypt certificate (R13). The site resolves to 82.98.168.24, an address owned by Dinahosting S.L in Spain. The hosting provider’s name servers (ns.dinahosting.com, ns.gestiondecuenta.com, ns2.dinahosting.com, ns2.gestiondecuenta.com) confirm the infrastructure belongs to the same provider. The page title returned by the server is simply “i.gal”, and no additional content has been disclosed in the current intelligence set. The web stack is identified as Apache HTTP Server delivering a front‑end built with Bootstrap, AngularJS and jQuery, which are common components in many phishing kits.

The domain appears on a single public blocklist, PhishDestroy, indicating that at least one anti‑phishing service has flagged it. Further corroboration comes from AlienVault OTX, where the address is referenced in 50 separate threat pulses, suggesting repeated observation by the community. VirusTotal scans show 10 of 91 antivirus engines flag the domain, reinforcing the suspicion of malicious activity. An MX record (mail.i.gal, priority 10) is present, which could be used for credential harvesting or spam distribution, though no mail traffic has been publicly observed. The registrar listed as Asociación PuntoGal provides limited transparency, and no brand or specific scam type is disclosed in the available data.

Consequently, the primary uncertainty lies in the exact payload delivered to victims; without a content snapshot, the precise phishing vector cannot be confirmed. Defenders should block i.gal at the network perimeter, add it to local deny lists, and monitor DNS queries for the domain and its associated IP. Email security gateways should treat any messages from mail.i.gal as suspicious, and users should be warned that any login prompt originating from this domain is likely fraudulent.