j67l[.]vip

The domain j67l.vip was registered on 19 May 2026 through NameMart Pte. Ltd. and is hosted on the IP address 103.27.177.163, which resolves to a network operated by Kowloon Telecommunications Co., Limited in Hong Kong. The site presents a valid TLS certificate issued by Let’s Encrypt (YR2), allowing encrypted HTTPS connections and returning HTTP 200 for the root page.

Threat intelligence sources have listed j67l.vip on a single security blocklist and it is actively blocked by the PhishDestroy filtering service. VirusTotal analysis shows that 20 of 95 scanned security vendors flag the domain as malicious, while the Gridinsoft trust engine assigns a score of 0 out of 100, indicating a high confidence of abuse. The HTTP response code of 200 suggests that a web server is actively serving content.

The combined indicators point to a generic phishing operation. The presence of a legitimate‑looking TLS certificate, the recent registration date, and the low trust score are consistent with campaigns that impersonate legitimate services to harvest credentials. No publicly available malware samples or payload URLs have been linked to the domain, leaving the exact phishing template and targeted brands uncertain.

Defenders should add the IP address 103.27.177.163 and the domain j67l.vip to outbound and inbound filtering rules, monitor DNS queries for the domain, and enforce TLS inspection to detect credential harvesting pages. Continuous re‑scanning on multi‑vendor platforms is advised, as additional detections may emerge. Organizations that rely on email or web gateways should ensure that the domain is blocked at the perimeter to mitigate credential theft risk.