195222666[.]com

This domain, 195222666.com, is identified as a credential theft phishing site designed to deceive users into submitting login credentials, financial details, or other sensitive information. The infrastructure mimics legitimate services, tricking victims into entering personal data under false pretenses. Such sites are commonly used in fraudulent campaigns targeting individuals, businesses, or organizations to facilitate account takeovers, identity theft, or unauthorized transactions. Analysis indicates the domain was registered on December 06, 2020, through GoDaddy.com, LLC, and resolves to the IP address 198.18.0.216, located in Hong Kong under AS135581 (ONL-HK). The site is flagged by 18 out of 95 security vendors on VirusTotal, confirming its malicious classification. Additional indicators include a default SSL certificate issued to 'Default Company Ltd,' a common red flag for hastily deployed phishing infrastructure. The domain appears on one security blocklist and was actively blocked by enterprise-level detection systems prior to being taken offline. If you visited 195222666.com or entered any information on the site, immediate action is required. First, cease all interaction with the domain and disconnect the affected device from the network to prevent further data exposure. Change passwords for any accounts accessed or entered on the site, prioritizing email, banking, and social media platforms. Enable multi-factor authentication (MFA) where available to add an additional layer of security. Monitor financial statements and credit reports for unauthorized activity, and report any suspicious transactions to the relevant institution. If the device used to access the site is shared or corporate-owned, notify IT or security teams to conduct a forensic review. Consider scanning the device with updated antivirus software to detect potential malware or backdoors installed during the interaction.