j70g[.]vip

Analysis of j70g.vip indicates a high‑risk credential phishing operation that is currently active. The domain was registered on May 25, 2026 through NameMart Pte. Ltd. and resolves to the IP address 208.87.202.34, which geolocates to Hong Kong. TLS is provided by a Let’s Encrypt certificate issued in the current year, and the web server returns HTTP 200, confirming that the site is reachable. Reputation data is poor: Gridinsoft assigns a trust score of 0/100, AlienVault OTX references the domain in a single threat pulse, and it appears on one security blocklist that is enforced by PhishDestroy. VirusTotal scans show 16 of 91 security vendors flagging the domain, reinforcing the malicious assessment. The only confirmed malicious behavior is the designation as a credential phishing site, matching the generic_phishing threat type. No additional artifacts such as malware samples, payload URLs, or compromised credentials have been published, leaving the specific phishing lure and target audience uncertain. Defenders should treat j70g.vip as hostile: block the domain at network perimeter, add the IP address to deny lists, and monitor DNS queries for look‑alike variations. Security tools should be updated to include the domain’s hash and URL patterns, and incident response teams should be prepared to investigate any credential submissions originating from this host. Continuous re‑evaluation is advised as further intelligence may emerge.