j106r[.]vip

Analysis of the domain j106r.vip, conducted on July 21, 2026, confirms its classification as a high-risk phishing site. The domain currently resolves to the IP address 103.27.177.164 and remains active, as verified by recent infrastructure checks. It is hosted on nameservers ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, and ns4.1111343.com, which are associated with other malicious domains and have been observed in previous phishing campaigns. The domain appears on one security blocklist, indicating prior detection by at least one threat intelligence provider. VirusTotal analysis shows that 1 of 95 security vendors has flagged the domain as malicious, though the specific detection rationale is not detailed in available intelligence. No additional context regarding the targeted brand, phishing kit, or exact credential harvesting mechanism is present in the current data. The page title and content have not been analyzed, and the scam type remains classified as generic phishing. Defenders are advised to treat this domain as hostile and implement blocking measures at the DNS or network level. Further investigation into the hosting IP 103.27.177.164 may reveal additional related domains or infrastructure used in this campaign. Given the domain's persistence and minimal detection coverage, monitoring for new indicators or shifts in hosting patterns is recommended.