j107c[.]vip

The domain j107c.vip has been identified as a high‑risk phishing infrastructure and is currently active. It is listed on a public security blocklist and has been blocked by the PhishDestroy sink‑hole service, indicating that the domain is actively used in malicious campaigns. VirusTotal reports that 18 of 95 scanning engines flag the domain as malicious, which reinforces the suspicion of malicious activity. DNS resolution points to the IPv4 address 103.27.177.164; no reputable hosting or content delivery provider is associated with that address, and the address does not appear in known safe‑hosting ranges. All four authoritative name servers (ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, ns4.1111343.com) belong to the same DNS provider, a pattern frequently observed in fast‑flux or disposable domain setups used to hide the true location of phishing payloads. The available intelligence does not include a page title, SSL certificate details, or observed HTTP response codes, so the exact content served by the site remains unknown. Consequently, the specific brand or service being impersonated cannot be confirmed at this time. The lack of visible content in public analyses suggests that the domain may be used in a redirect chain or that the payload is delivered only to targeted victims. Defenders should therefore assume a generic phishing intent and treat any traffic to the domain as malicious. Recommended mitigation steps include adding j107c.vip to network‑level deny lists, blocking the associated IP address 103.27.177.164, and monitoring DNS queries for the listed name servers. Security appliances that support threat‑intelligence feeds should ingest the blocklist entry and the VirusTotal detection count. Continuous observation of the domain’s DNS records is advised, as the infrastructure may shift to new IP addresses or additional name servers as part of an evasion strategy.