b47i[.]vip

Analysis of b47i.vip indicates that it is actively used for phishing. The domain resolves to the IPv4 address 103.27.177.163. DNS resolution is served by four authoritative name servers—ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, and ns4.1111343.com—each a sub‑domain of 1111343.com, a pattern observed in other malicious campaigns and suggesting a shared hosting arrangement. The domain appears on one public security blocklist and has been referenced in two AlienVault OTX threat‑intelligence pulses, confirming prior malicious activity. Commercial detection services have flagged the domain; VirusTotal reports that 1 of 91 scanned security vendors identified it as malicious. In addition, the domain is blocked by the PhishDestroy sinkhole, reinforcing its classification as phishing infrastructure. The current operational status is active, meaning the domain continues to resolve and can be reached by victims. No SSL/TLS certificate data or HTTP response details are present in the available intelligence, limiting visibility into the payload delivered. Defenders should add both the domain name and its resolved IP address (103.27.177.163) to network‑level deny lists, enforce DNS‑based blocking, and monitor outbound traffic for connections to this host. URL filtering, credential‑exfiltration detection, and isolation of any compromised endpoints are recommended. Continuous re‑scanning on multi‑engine platforms is advised to capture any changes in vendor detection. Correlation with the two OTX pulses may help identify related command‑and‑control infrastructure. Until further evidence is obtained, the domain should be treated as high‑risk and blocked in all user environments.