195917[.]com

This domain, 195917.com, is identified as a generic phishing infrastructure targeting users through a deceptive interface labeled "智能线路选择" (Smart Route Selection). Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, but the page title suggests an attempt to mimic legitimate network or routing service providers. The lack of identifiable branding or known phishing kits implies a broader, less targeted approach, likely intended to harvest credentials or distribute malicious payloads under the guise of a technical utility. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 129.227.90.113, hosted on AS21859 (Zenlayer Inc) in Singapore. It was registered on March 10, 2021, through GoDaddy.com, LLC, and uses a default SSL certificate issued to "Default Company Ltd." Detection metrics show 17 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on one security blocklist and was actively blocked by at least one threat intelligence feed. No Google Safe Browsing (GSB) entries were identified in the provided data, though this does not preclude prior or subsequent listings. As of the latest assessment, 195917.com has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed for future malicious campaigns. The elevated risk level is attributed to the domain's history, detection rate, and infrastructure characteristics, including its hosting provider and default SSL configuration. Users are advised to treat any prior interactions with this domain as compromised, reset credentials for associated accounts, and monitor for unauthorized activity. Network administrators should ensure blocklist updates are applied to prevent access if the domain resurfaces.