j95m[.]vip

Analysis indicates that the domain j95m.vip was registered on June 18, 2026 through NameMart Pte. Ltd. The authoritative name servers are ns1.1111343.com, ns2.1111343.com, ns3.1111343.com and ns4.1111343.com, and DNS resolution points to the IPv4 address 103.27.177.163. The domain appears on two public phishing blocklists and is actively blocked by the PhishDestroy and OpenPhish feeds, confirming that it is being used in a phishing campaign. VirusTotal records show that two of ninety‑five scanned scanners have flagged the domain, suggesting that at least a minority of security products have identified malicious behavior associated with the host.

The limited detection count does not imply safety; rather, the presence on dedicated phishing feeds and the recent creation date are strong indicators of malicious intent. No public SSL certificate details, HTTP response codes, or page‑title information have been disclosed, leaving the exact content of the site undefined. Consequently, defenders cannot confirm the precise phishing lure or victim targeting, only that the infrastructure is characteristic of a newly created phishing operation.

Mitigation recommendations include adding the domain to local deny lists, updating URL filtering policies to block both the FQDN and its IP address, and monitoring DNS queries for the associated name servers. Organizations should also ensure that email security gateways reference the PhishDestroy and OpenPhish feeds to capture inbound messages containing j95m.vip links. Continuous re‑evaluation is advised, as further analysis may reveal additional indicators such as malicious payloads or compromised credentials.