95pg09[.]com

Analysis of the domain 95pg09.com indicates a credential phishing campaign targeting users of the platform referenced in its page title, 95PGPLAY.COM. The domain was registered on February 27, 2026, through GMO Internet, Inc., a registrar commonly associated with both legitimate and malicious registrations. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3, which is geolocated in Canada and hosted by Cloudflare, Inc. The use of Cloudflare nameservers (chance.ns.cloudflare.com and jamie.ns.cloudflare.com) and the presence of HTTP/3 and Vue.js technologies suggest an attempt to leverage modern web infrastructure to evade detection and enhance the site's perceived legitimacy. Notably, the domain lacks an SSL certificate, which is atypical for contemporary phishing sites but may reflect an oversight or a deliberate tactic to avoid certificate transparency logs. Detection data from security vendors is limited but indicative of malicious intent.

As of the latest available scan, three out of ninety-four security vendors on VirusTotal flagged the domain as malicious. Additionally, the domain appears on one security blocklist and is explicitly blocked by PhishDestroy. Gridinsoft assigns the domain a trust score of 0/100, further corroborating its classification as high-risk. The domain is currently offline, which may indicate takedown efforts or a temporary cessation of activity. Defenders should treat this domain as part of an active phishing campaign targeting users of 95PGPLAY.COM.

The combination of Cloudflare hosting, the absence of SSL, and the use of modern web technologies such as Vue.js and HTTP/3 warrants heightened scrutiny. While the exact content of the phishing page remains unanalyzed, the page title and detection data strongly suggest an intent to harvest credentials. Organizations should ensure that endpoint protection and web filtering solutions are updated to block this domain and its associated IP address.