On 30 July 2026 the domain 65.jj37799.vip was observed actively resolving to the IPv4 address 52.246.136.207. VirusTotal analysis shows that 11 of 91 scanned security vendors have flagged the host as malicious, indicating a moderate consensus of detection across multiple engines. The domain is listed on a single external security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. No authoritative nameserver information could be retrieved; the query for NS records returned NS_NOT_FOUND, which suggests either rapid changes in DNS configuration or deliberate concealment of hosting details.
The current WHOIS data, registration timestamps, and SSL certificate information were not provided, leaving the registrar and certificate provenance unknown. The threat classification supplied is "generic phishing", and the risk level is marked as high, implying that the site is likely used to harvest credentials or personal information without targeting a specific brand. Because the site remains active at the time of assessment, defenders should treat any outbound traffic to 65.jj37799.vip as suspicious. Immediate remediation steps include adding the domain and its resolved IP address to perimeter blocklists, updating web‑proxy and DNS filtering rules, and ensuring that endpoint detection solutions incorporate the 11 vendor detections from VirusTotal.
Continuous monitoring of the IP reputation and periodic re‑scans on VirusTotal are advised to capture any changes in detection scores. Where possible, network teams should also query passive DNS feeds to identify any additional resolution patterns that may indicate a fast‑flux infrastructure. Until further forensic evidence is obtained, the domain should be considered hostile and blocked across all user‑facing services.
ChainPatrol
Web-Check 
SOCRadar 
LeakIX 
