195qq195[.]com

This domain, 195qq195.com, is identified as a credential theft operation designed to harvest user login credentials through deceptive landing pages. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, though the infrastructure aligns with broader credential harvesting campaigns. The domain employs generic but effective social engineering tactics, likely mimicking login portals for popular services to trick victims into submitting sensitive information. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on July 23, 2019, and resolves to the IP address 103.143.28.212, hosted under AS135581 (ONL-HK) in Hong Kong. The SSL certificate, issued to Default Company Ltd, further suggests a lack of legitimate organizational affiliation. Detection metrics indicate elevated risk: 19 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on one additional security blocklist. No Google Safe Browsing (GSB) entries were observed at the time of analysis, though this does not diminish the domain's confirmed malicious classification. As of the latest assessment, 195qq195.com has been taken offline, likely in response to security vendor detections and blocklist inclusion. Despite its current inactive status, residual risk persists due to the domain's historical use in credential theft campaigns. Users who may have interacted with the domain are advised to reset passwords for any accounts accessed during the exposure window and monitor for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.