195000444[.]com

Analysis of the domain 195000444.com indicates active phishing infrastructure as of July 23, 2026. The domain, registered on December 6, 2020, through GoDaddy.com, LLC, remains operational with a high-risk classification. It resolves to the IP address 103.143.28.212, hosted in Hong Kong under AS135581 (ONL-HK). Nameservers are configured to Cloudflare (dee.ns.cloudflare.com and santino.ns.cloudflare.com), a common practice among threat actors to obscure hosting origins and leverage CDN protections. Security vendor detections are notable: 19 of 93 engines on VirusTotal flag the domain as malicious, while AlienVault OTX lists it in one threat intelligence pulse.

The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk status. The SSL certificate is issued to 'Default Company Ltd,' a generic placeholder often associated with automated or low-effort malicious registrations. The HTTP response code is 302, suggesting a redirect mechanism, though the destination remains unconfirmed in available data.

The page title, '195000444.com,' provides no clear indication of a targeted brand or scam type, and no specific phishing kit or campaign has been attributed to this domain in open-source intelligence. While the infrastructure aligns with typical phishing operations—including Cloudflare usage, recent detections, and a low-trust score—the exact content or lure remains unanalyzed. Defenders should treat this domain as active phishing infrastructure, block it at the network level, and monitor for connections from internal assets. Further investigation into redirect chains and associated payloads is recommended to determine the full scope of the threat.