j99t[.]vip

The domain j99t.vip is currently flagged as an active crypto drainer phishing site, designed to illicitly extract cryptocurrency assets from victims by mimicking legitimate wallet interfaces or transaction prompts. Analysis confirms the domain remains operational, posing a direct financial threat to users engaging with its content. No specific brand impersonation has been conclusively identified, but the infrastructure aligns with known crypto-focused phishing campaigns targeting decentralized finance (DeFi) platforms and wallet users. Infrastructure analysis reveals the domain resolves to the IP address 103.27.177.163 and was registered on June 22, 2026, through NameMart Pte. Ltd. Security vendors on VirusTotal have flagged j99t.vip as malicious, with 12 of 95 engines detecting it as a phishing or fraudulent resource. The domain utilizes a Let's Encrypt SSL certificate, a common tactic among threat actors to create a veneer of legitimacy. No additional blocklist counts or trust scores from alternative threat intelligence platforms were provided, but the existing detection rate underscores a high-risk profile. Current status indicates the domain remains active and unmitigated, requiring immediate attention from network defenders and end-users. Organizations are advised to block the domain and its associated IP at the perimeter level, while individuals should avoid interacting with any content hosted on j99t.vip. Users who may have engaged with the site should revoke any connected wallet permissions, monitor transaction histories for unauthorized activity, and rotate credentials for any accounts accessed during the suspected compromise. Proactive monitoring of related infrastructure, including domains registered through NameMart Pte. Ltd. and IPs within the 103.27.177.0/24 range, is recommended to identify potential lateral threats.