195000999[.]com

This domain, 195000999.com, has been identified as a credential theft phishing site targeting users through deceptive login interfaces. Analysis indicates the domain is currently offline, though prior activity suggests it was actively harvesting sensitive authentication details. No specific brand impersonation was confirmed, but the infrastructure aligns with broad credential harvesting campaigns. Infrastructure analysis reveals the domain was registered on December 06, 2020, through GoDaddy.com, LLC, and resolves to the IP address 103.143.28.212, hosted in Hong Kong under AS135581 (ONL-HK). The domain appears on one security blocklist and is flagged by 17 of 95 VirusTotal vendors as malicious. The SSL certificate, issued to Default Company Ltd, lacks valid organizational validation, further indicating suspicious intent. The page title, identical to the domain name, suggests minimal effort to mimic legitimate services, a common tactic in low-sophistication phishing operations. Current status confirms the domain has been taken offline, though residual risk remains due to potential re-activation or migration to similar infrastructure. Organizations are advised to block the domain and associated IP (103.143.28.212) at the perimeter, update endpoint detection rules to include this indicator, and monitor for related phishing attempts using the same registrar or hosting provider. Users should be educated on recognizing credential theft tactics, particularly unsolicited login prompts or generic page titles that do not match expected brand identifiers. Historical logs should be reviewed for connections to this domain or IP to assess potential prior compromise.