65[.]jj38127[.]vip

On 27 July 2026 the domain 65.jj38127.vip was observed actively used in a credential‑harvesting campaign. The domain is listed on a single security blocklist and is currently blocked by the PhishDestroy service, indicating that at least one anti‑phishing feed has classified it as malicious. VirusTotal scans show that eight of ninety‑one AV engines flagged the domain, providing independent confirmation of its malicious nature. The domain resolves to the IPv4 address 57.158.99.232; no additional hostnames were observed sharing this address in the available data.

Nameserver queries returned no records, suggesting that the authoritative DNS configuration is either hidden or deliberately omitted, a technique often used to hinder takedown efforts. No public registrar information, SSL certificate details, or HTTP response codes were available at the time of analysis, and Safe Browsing, OTX, and other reputation services did not return explicit entries for the domain. Consequently, the full scope of the infrastructure—such as whether the IP belongs to a cloud provider, a compromised host, or a dedicated phishing server—remains uncertain. The lack of a page title or content snapshot prevents assessment of the specific luring tactics employed, but the classification as a generic phishing campaign implies that the site likely hosts credential‑collection forms targeting a broad audience.

Defenders should add 65.jj38127.vip to local deny lists and ensure that network perimeter controls block traffic to the associated IP address 57.158.99.232. Monitoring DNS queries for the domain and its resolver patterns can help detect any future re‑use of the same name or similar subdomains. Because the domain’s nameserver data is missing, threat‑intel teams should consider querying passive DNS feeds for historic records that may reveal additional infrastructure ties.