195444666[.]com

This domain, 195444666.com, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. Analysis of the infrastructure reveals no direct association with known brand impersonation or cryptocurrency drainer kits, though the use of a generic 'Privacy error' page title suggests an attempt to mimic legitimate service interruptions. The lack of a customized SSL certificate, evidenced by the 'Default Company Ltd' issuer, further indicates low-effort phishing tactics commonly employed in opportunistic campaigns. Technical indicators confirm elevated risk levels. The domain resolves to the IP address 23.145.136.50, hosted under AS209242 in Japan, and was registered through GoDaddy.com, LLC on February 21, 2026. Detection metrics reveal a VirusTotal score of 22/95 security vendors flagging the domain, while only one security blocklist currently lists it. The domain's SSL certificate, issued to a generic entity, aligns with patterns observed in transient phishing infrastructure. No Google Safe Browsing (GSB) detections were recorded at the time of analysis, though this may reflect a lag in propagation rather than absence of malicious intent. As of the latest assessment, 195444666.com has been taken offline, likely due to enforcement actions by hosting providers or registrars. However, the domain's recent creation date and the use of bulletproof hosting patterns suggest a potential for rapid redeployment under alternative infrastructure. Users who may have interacted with the domain are advised to reset credentials for any services accessed during the exposure window. Organizations should monitor for related domains registered through the same registrar or resolving to the identified IP range, as these may indicate follow-up campaigns. The elevated risk level persists due to the domain's technical indicators and the likelihood of threat actor persistence.