295[.]lol

PhishDestroy’s threat intelligence team has flagged 295.lol as an active credential-harvesting domain designed to trick users into surrendering sensitive login credentials. This domain mimics legitimate login portals—most often banking, email, or corporate services—through carefully crafted phishing pages that harvest usernames, passwords, and multi-factor authentication codes. The page content and structure are engineered to bypass basic user scrutiny, often leveraging urgency or security alerts to prompt immediate action. Threat actors routinely rotate domains like 295.lol to evade detection, making timely identification critical to preventing account compromise. This domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on April 20, 2026, and is currently resolving to IP address 188.114.97.3. Notably, VirusTotal currently shows 2 out of 95 security engines flagging this domain, and it remains absent from all major DNS-based blocklists at the time of analysis. The presence of a valid Let's Encrypt SSL certificate further increases the appearance of legitimacy, potentially luring even security-conscious users into a false sense of security. The domain’s recent creation and lack of detections indicate it is likely in the early stages of a phishing campaign, emphasizing the need for immediate action. If you have visited 295.lol or entered any credentials on its pages, immediately change your passwords on all affected accounts and enable two-factor authentication where available. Scan your device with updated antivirus software to detect any latent malware. Report the domain to your IT department or security team and consider notifying your bank or service provider if financial or email credentials were exposed. Monitor your accounts closely for unusual activity and enable transaction alerts. For further analysis and IOCs, refer to the full PhishDestroy threat report linked below.