195333222[.]com

This domain, 195333222.com, is identified as a phishing infrastructure targeting cryptocurrency wallet users through credential harvesting and potential crypto drainer mechanisms. Analysis indicates the absence of explicit brand impersonation, suggesting a generic or opportunistic phishing campaign designed to exploit users seeking wallet-related services. The domain exhibits characteristics consistent with automated phishing kits, including default SSL certificates and minimal page content, which are typical of low-effort, high-volume attacks. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on December 06, 2020, and resolves to the IP address 103.143.28.212, hosted on AS135581 (ONL-HK) in Hong Kong. The SSL certificate is issued to "Default Company Ltd," a common placeholder in phishing operations. Detection metrics show the domain is flagged by 21 out of 95 security vendors on VirusTotal, with additional listings on two blocklists: PhishDestroy and PhishingDB. No Google Safe Browsing (GSB) entries were reported at the time of analysis, though this may reflect delayed or incomplete coverage. The domain has since been taken offline, likely due to enforcement actions by hosting providers or registrars following abuse reports. However, residual risk persists due to the domain's age and prior activity, which may have exposed victims to credential theft or asset loss. Organizations and users are advised to monitor for related indicators, including the IP address 103.143.28.212 and the registrar's abuse channels for potential follow-up. Proactive blocking of the domain and associated infrastructure is recommended to mitigate further exposure.