65[.]jj38638[.]vip

Analysis indicates that the domain 65.jj38638.vip was registered on July 29, 2026 through Dynadot Inc. The authoritative name servers are n1.xundns.com and n2.xundns.com, and DNS resolution points to the IPv4 address 40.81.25.117. The domain currently appears on a single security blocklist and is listed as blocked by PhishDestroy, confirming active use in malicious campaigns. VirusTotal data show that six of ninety‑one scanning engines have flagged the domain, providing independent corroboration of its malicious reputation. The presence on PhishDestroy indicates that the domain has been observed delivering credential‑harvesting pages, although the specific landing page has not been publicly disclosed.

No additional public intelligence such as Safe Browsing verdicts, OTX references, SSL certificate details, HTTP response codes, or page‑title information is presently available, limiting the ability to characterize the exact phishing payload or targeted brand. The IP address 40.81.25.117 is hosted in a cloud environment that historically has been abused for short‑term phishing hosting, but no ASN or country attribution is provided in the current feed. The limited detection footprint combined with recent registration suggests a short‑lived infrastructure typical of opportunistic phishing operators. Defenders should add 65.jj38638.vip to URL filtering and DNS sinkhole rules, monitor outbound connections to 40.81.25.117, and enforce blocklist updates that include this domain.

Because the registrar is Dynadot Inc, threat‑intel teams may consider requesting WHOIS amendment logs or abuse contacts for possible takedown. Organizations should prioritize detection of outbound traffic to this address and consider employing heuristic or machine‑learning models that flag newly created domains with similar characteristics. Integration of this indicator into SIEM correlation rules can help surface related phishing attempts that may use the same infrastructure.