195222888[.]com

195222888.com, a phishing domain, has been flagged by 20 out of 95 vendors on VirusTotal, indicating a significant threat level. The domain was registered with GoDaddy.com, LLC and hosted on IP address 198.18.0.230 in Hong Kong under ASN AS135581 ONL-HK. Despite its current offline status, the domain was actively used in phishing operations.

The domain's SSL certificate was issued by Default Company Ltd, a detail that often suggests a lack of legitimate business operations. The domain was created on December 6, 2020, but it was not detected by PhishDestroy until December 17, 2025. This indicates that the domain may have been dormant or under the radar for a significant period before being leveraged for malicious activities.

The presence of 20 detections on VirusTotal highlights the domain's malicious nature, and its inclusion on a public blocklist by PhishDestroy further underscores its risk. The domain's takedown and offline status mitigate its current threat, but the case exemplifies the importance of timely detection and response to phishing threats. The use of a reputable registrar like GoDaddy and a Hong Kong-based hosting provider reflects common tactics used by threat actors to lend legitimacy and obscure their operations.