dyjjy[.]com

Analysis of dyjjy.com indicates a high‑risk generic phishing operation that remains active as of 12 July 2026. The domain resolves to 23.225.59.157, an address hosted by CloudRadium L.L.C. in the United States and serves HTTP 200 responses with a valid Let’s Encrypt R12 certificate. The site’s page title is identical to the domain name, providing no additional context, and the HTTP status suggests the infrastructure is fully functional. The domain was registered on 11 March 2026 through West263 International Limited and is delegated to six nameservers (ns1.363.hk, ns2.363.hk, ns3.363.hk, ns4.363.hk, ns5.363.hk, ns6.363.hk). These nameservers are consistent with other malicious infrastructure observed in recent campaigns, reinforcing the likelihood of deliberate provisioning for phishing purposes. No further public WHOIS details beyond registrar and creation date are available. Reputation data shows dyjjy.com appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, confirming active mitigation by multiple providers. AlienVault OTX has recorded the domain in one threat‑intelligence pulse, and VirusTotal reports that ten of ninety‑five scanned security vendors flag the domain as malicious. Gridinsoft assigns a trust score of zero out of one hundred, underscoring the consensus of malicious intent across independent scanners. Given the confirmed generic phishing classification, defenders should enforce network‑level blocking of the domain and its resolving IP, incorporate the listed nameservers into threat‑intel feeds, and monitor for any related sub‑domains that may be created under the same registrar. Continuous re‑evaluation of VirusTotal and blocklist telemetry is advised to capture any changes in detection rates. Organizations should also consider sinkholing traffic to the IP address to disrupt credential harvesting attempts while users are educated about the risk.