b47h[.]vip

The domain b47h.vip is currently active and has been classified as a generic phishing site. DNS resolution points to the IPv4 address 103.27.177.163, and the zone is served by four name servers (ns1.1111343.com through ns4.1111343.com). VirusTotal records show that 1 of 95 scanned security vendors flagged the domain, indicating at least one detection. The domain is listed on a single public blocklist and is explicitly blocked by the PhishDestroy service, confirming that external threat‑sharing platforms consider it malicious. No additional public intelligence such as Safe Browsing entries, OTX references, SSL certificate details, HTTP response codes, or page‑title metadata have been observed for this host, so the exact content and targeted brand remain unknown. The limited visibility suggests that the operator may be using a lightweight infrastructure, possibly rotating content or employing short‑lived pages to evade detection. Defenders should immediately add b47h.vip and its resolving IP address 103.27.177.163 to network‑level deny or sink‑hole rules. Monitoring of DNS queries for the four associated name servers can provide early warning of new activity. Because the domain is already present on a blocklist, incorporation of that list into existing email and web filtering solutions will reduce the likelihood of end‑user exposure. Continuous re‑scanning of the domain with multi‑engine services is advised, as additional detections may appear if the site expands its payload or hosting. Organizations that employ outbound traffic monitoring should also flag any connections to the listed IP range, and SOC analysts should correlate any related alerts with the known indicator set to prioritize investigation.