195926[.]com

The domain 195926.com is currently active and has been classified as a high‑risk brand‑impersonation site targeting Bet365. Registration data shows the domain was created on 1 June 2021 through GoDaddy.com, LLC, and it resolves to the IP address 203.168.128.178, which is hosted in Japan under ASN 135074 (DREAM CLOUD INNOVATION PTE. LTD.). The site serves content over HTTPS using a Let’s Encrypt certificate (R12) and enforces HTTP Strict Transport Security, indicating a modern TLS configuration.

HTTP requests return a 200 status code, and technology fingerprints reveal the presence of jQuery alongside HSTS support. Reputation services provide mixed signals: Scamadviser assigns a trust score of 45 / 100, while Gridinsoft rates the domain at 0 / 100, suggesting a low level of confidence in the site’s legitimacy. Detection coverage is significant; VirusTotal reports that 21 of 93 security vendors have flagged the domain, and it appears on a single security blocklist. PhishDestroy has explicitly blocked the domain, and AlienVault OTX lists it in two threat‑intelligence pulses, reinforcing the perception of malicious intent.

Nameserver resolution points to Cloudflare (alexis.ns.cloudflare.com, blair.ns.cloudflare.com), a common choice for fast‑changing malicious infrastructure. While the exact phishing page content has not been publicly disclosed, the combined evidence—high vendor detection rate, blocklist presence, low trust scores, and targeted impersonation of the Bet365 brand—indicates a credible credential‑harvesting operation. Defenders should add 195926.com to URL filtering and domain‑allowance deny lists, monitor outbound connections to the associated IP, and enforce strict email‑gateway rules to block any communications referencing Bet365 login URLs that resolve to this domain. Continuous threat‑intel feeds should be consulted for any emerging indicators related to this infrastructure.