j111d[.]vip

This domain, j111d.vip, is flagged as a high-risk phishing site with active status as of July 12, 2026. Registered on June 29, 2026, through NameMart Pte. Ltd., the domain resolves to the IP address 103.27.177.164, hosted in Hong Kong under the provider TELECOMMUNICATIONS CO., LIMITED. Infrastructure analysis reveals the use of Cloudflare, Nginx, and HTTP/3, alongside HSTS and Vue.js, suggesting a modern web stack designed to evade detection or enhance user interaction. The domain is associated with four nameservers (ns1.1111343.com through ns4.1111343.com), which may indicate a broader malicious infrastructure. It appears on one security blocklist and is flagged by 20 of 91 security vendors on VirusTotal, confirming its classification as malicious. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for both legitimate and malicious sites due to its accessibility. The HTTP status code 200 indicates the site is currently serving content, though the exact nature of the phishing campaign—such as targeted brands or specific credential harvesting techniques—remains unconfirmed. Defenders should treat this domain as hostile and prioritize blocking it at the DNS, proxy, or firewall level. Monitoring for connections to 103.27.177.164 or the associated nameservers may help identify compromised endpoints within networks. Given the domain's recent registration and active status, further investigation into its hosting provider and registrar is recommended to assess potential takedown or mitigation options.