195222777[.]com

195222777.com entered the PhishDestroy evidence set on Dec 17, 2025. The stored content classification is brand impersonation. The assembled evidence scores 100/100 (critical).

Two independent sources are positive: VirusTotal and Cloudflare Radar. VirusTotal recorded 20 detections among 95 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, MalwareURL, Netcraft, Seclookup, SOCRadar, Sophos, VIPRE, Webroot on Jul 18, 2026 at 18:02 UTC. Cloudflare Radar classified the hostname as malicious and assigned the categories phishing and security threats; its verdict timestamp was not retained. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:20 UTC. URLScan completed without a malicious verdict. PhishStats returned no feed match on Mar 1, 2026 at 08:02 UTC.

HTTP 302 was recorded on Aug 7, 2026 at 10:49 UTC. Registration records for the domain list GoDaddy.com, LLC as the registrar and Dec 5, 2020 as the creation date. At collection time, the hostname resolved to 198.18.0.222 on AS135581 (ONL-HK-AS 19 Chun Wang Street, Tseung Kwan O Industrial Estate, N.T. Hong Kong, HK). The associated network metadata labels the endpoint as AS135581 ONL-HK in Tung Chung, HK. The stored server header is nginx. DOM analysis completed on Mar 11, 2026 at 09:21 UTC; stored DOM score 0/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Jul 29, 2026 at 02:40 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists Default Company Ltd as the certificate issuer with validity through Aug 13, 2022; checked Mar 12, 2026 at 01:31 UTC.

No page title was retained; the visual captures, not a title string, preserve the landing-page appearance. No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings. Taken together, the page content and independent findings support classifying this hostname as brand impersonation.