What Gridinsoft observed on my.link.gallery
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260812072120-969f9991
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Phishing
- Evidence basis
- First-party site analysis External vendor intelligence: Context only — not used for this decision
The independent first-party review directly reproduced current phishing behavior reachable from an active user-controlled LinkGallery object. Although the root operator service is legitimate shared infrastructure and the result does not describe every tenant, the active delegated object currently supports retaining the Phishing classification.
Analyst findings
Review 5 documented observations View evidence
The root and sampled public profiles presented a functioning shared LinkGallery service. The reviewed root page did not itself present a password, payment-card, or file-upload form.
-
HTTP status
200 -
Final URL
https://my.link.gallery/ - Analyst observation The service exposes user-controlled public profiles and link destinations, so a clean root page cannot establish the safety of the delegated namespace.
A current public LinkGallery data object returned two links marked active, including a direct destination on the IPFS public gateway.
-
HTTP status
200 -
Redirect destination
https://ipfs.io/ipfs/bafkreifcworvqfrgqldcrhsvxdkqhokifckyqgalhruqwqwtyrwummonhy - Analyst observation The reviewed public data object marked the destination link active=true at the recorded time.
Repeated mobile-client requests returned a page titled Secure Authentication Flow that imitated a Microsoft-style sign-in and collected a password followed by payment-card details.
-
HTTP status
200 - MIME type text/html
- Page element Password input and Sign in control
- Page element Payment fields for card number, name, expiry, and CVV with a Submit Payment control
- Analyst observation The page used Microsoft-referencing sign-in language but was served from an unrelated public IPFS gateway object.
The exact destination was available as the credential and payment-card form to a mobile client while a desktop client received an IPFS gateway error, demonstrating client-dependent availability during the review.
-
HTTP status
504 - Analyst observation The desktop response reported that no providers were found, while the mobile response returned the active form with HTTP 200.
No executable, automatic file download, or specific malware payload was identified in the reviewed flow. The current observed harm was credential and payment-data phishing.
- Analyst observation The reviewed flow collected credentials and payment-card data; it did not deliver a reviewed malware file.
Scope and limitations
- User-controlled profile and destination content can change after the recorded review.
- The result does not attribute creation, intent, or malicious conduct to the platform operator and does not state that every tenant is malicious.
- Public search and index records were used for discovery only; the verdict was based on direct current HTTP observations.
- The exact destination behaved differently by client profile during the review, but the credential and payment-card form was reproduced in repeated mobile-client requests.
Help protect others by sharing this page on social media! The more people who know about my.link.gallery, the fewer chances they have to deceive someone else. Help others evaluate my.link.gallery by sharing this page on social media!