j61j[.]vip

Analysis of j61j.vip confirms active phishing infrastructure. The domain was registered on May 17, 2026, through NameMart Pte. Ltd. and currently resolves to the IP address 103.27.177.164. A Let's Encrypt SSL certificate is present, which is commonly used across both legitimate and malicious sites to encrypt traffic. As of July 16, 2026, six out of 95 security vendors on VirusTotal have flagged the domain, indicating detection by multiple engines but not yet widespread consensus. The exact content hosted on j61j.vip has not been fully analyzed, so the specific brand or service being impersonated remains unconfirmed. No known phishing kit or targeted brand is currently associated with this domain in available intelligence. The domain's recent creation date and detection by security vendors suggest it is part of a broader phishing campaign, though its longevity or intended victim profile is unclear. Defenders should treat j61j.vip as high-risk infrastructure. Network-level blocking of the domain and its resolving IP is recommended. Security teams should monitor for connections to 103.27.177.164 and review logs for any interaction with j61j.vip, particularly from users who may have entered credentials or sensitive data. Further investigation into the domain's hosting provider and associated infrastructure may reveal additional related threats.