j110p[.]vip

This domain, j110p.vip, is classified as a high-risk credential theft operation designed to harvest user login credentials, financial details, or other sensitive information. Analysis indicates the infrastructure is actively targeting individuals through deceptive login portals, fake verification pages, or impersonation of legitimate services. The threat type is narrowly defined as credential theft, not generic phishing, due to observed patterns of form submission interception and session token exfiltration. Infrastructure analysis reveals multiple indicators of malicious intent. The domain was registered on June 29, 2026, through NameMart Pte. Ltd., a registrar frequently associated with abusive registrations. It currently resolves to the IP address 103.27.177.164, a host with a history of hosting phishing campaigns. Security vendor detections on VirusTotal stand at 12/95, with blocklists such as Google Safe Browsing, OpenPhish, and PhishTank flagging the domain. The SSL certificate, issued to Default Company Ltd, further suggests automated or low-effort deployment, a common trait in credential theft operations. No legitimate trust scores or reputation services associate this domain with verified entities. To mitigate risks associated with credential theft, users should avoid interacting with j110p.vip entirely. If accidental access occurs, immediately terminate the session and refrain from entering any credentials. Organizations should block the domain and its resolving IP (103.27.177.164) at the network perimeter and monitor for unauthorized access attempts linked to this infrastructure. Multi-factor authentication (MFA) should be enforced for all accounts to reduce the impact of stolen credentials. Security teams are advised to review logs for connections to the domain or IP and conduct password resets for any potentially exposed accounts.