195444999[.]com

This domain is flagged for credential theft phishing, targeting users with fraudulent login portals designed to harvest authentication details. The risk level is elevated due to confirmed malicious activity and infrastructure linked to prior phishing campaigns. Analysis indicates the domain was actively used to impersonate financial institutions or corporate login pages, a common tactic in credential harvesting operations. Infrastructure analysis reveals the domain was registered on December 06, 2020, through GoDaddy.com, LLC. It resolves to the IP address 198.18.0.210, hosted in Hong Kong under AS135581 (ONL-HK). Security vendors on VirusTotal flagged the domain as malicious, with 20 out of 95 detections confirming its involvement in phishing. The SSL certificate, issued to 'Default Company Ltd,' further indicates a lack of legitimate business validation. The domain appears on one security blocklist and was previously blocked by enterprise phishing detection systems. Mitigation steps for credential theft phishing include immediate blacklisting of the domain across all network security controls, including firewalls, email gateways, and endpoint protection. Organizations should conduct a retrospective analysis of logs to identify any prior connections to 198.18.0.210 or the domain itself, particularly from systems that may have interacted with financial or corporate login pages. Users who accessed the domain should be required to reset credentials for any accounts entered on the site, with multi-factor authentication enforced to prevent unauthorized access. Security teams should monitor for similar domains registered through the same registrar or hosted on adjacent IP ranges, as threat actors often reuse infrastructure for follow-up campaigns.