195972[.]com

The domain 195972.com has been identified as a credential harvesting phishing infrastructure. Analysis indicates the domain is currently offline, though it previously hosted content designed to deceive users into submitting login credentials or sensitive information. No specific brand impersonation has been confirmed at this time, but the domain exhibits characteristics consistent with generic phishing campaigns targeting a broad range of services. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on February 21, 2026, and resolves to the IP address 203.168.128.221, hosted under AS135074 (DREAM CLOUD INNOVATION PTE. LTD.) in Japan. The domain is flagged by 20 of 95 security vendors on VirusTotal, and appears on at least one security blocklist. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites due to its accessibility. The creation date, while unusual for a phishing domain, may indicate an attempt to evade detection by appearing as a newer, unmonitored resource. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the infrastructure remains registered and could be reactivated. Organizations are advised to block the domain and associated IP address at the network perimeter. End users should be educated on recognizing phishing attempts, particularly those leveraging newly registered domains or unexpected login prompts. Security teams are encouraged to monitor for related domains registered through the same registrar or hosted on the same IP range, as threat actors often reuse infrastructure across campaigns.