195000555[.]com

This domain, 195000555.com, is identified as a fake login phishing portal designed to harvest user credentials. Analysis indicates the site mimics legitimate authentication pages to deceive visitors into entering sensitive information. The domain is currently offline, but prior activity suggests it was actively targeting users before being taken down. Infrastructure analysis reveals the domain was flagged by 21 of 95 security vendors on VirusTotal, indicating broad consensus on its malicious nature. It was registered through GoDaddy.com, LLC on December 06, 2020, and resolved to the IP address 103.143.28.212, hosted under AS135581 (ONL-HK) in Hong Kong. The SSL certificate was issued to a generic entity, 'Default Company Ltd,' a common red flag in phishing operations. The domain appears on at least one security blocklist, further corroborating its malicious classification. Current status confirms the domain is offline, reducing immediate exposure risk. However, the infrastructure remains a potential threat if reactivated. Organizations and users are advised to block the domain and its associated IP (103.143.28.212) at the network level. Security teams should monitor for related domains registered under the same registrar or resolving to the same IP range. Users who may have interacted with the site should reset credentials immediately and enable multi-factor authentication on all critical accounts. Proactive threat hunting for indicators of compromise, such as unusual login attempts or unauthorized access, is recommended.