91jaiho[.]xyz

This domain, 91jaiho.xyz, is flagged as a generic phishing portal designed to impersonate the Jaiho91 platform. Analysis of the page title, 'Join in Jaiho91 !!!', indicates an attempt to deceive users into engaging with fraudulent content, likely for credential harvesting or unauthorized access to accounts. No specific drainer kit signatures have been confirmed, though the infrastructure aligns with common phishing toolkits observed in recent campaigns. Technical indicators reveal the domain was registered on May 09, 2026, through NameSilo, LLC, a registrar frequently associated with malicious domains. It resolves to the IP address 52.222.214.35, hosted on Amazon CloudFront infrastructure in Germany, suggesting the use of content delivery networks to obfuscate origins. VirusTotal reports 9 out of 95 security vendors detecting the domain as malicious, while it appears on a single blocklist, PhishDestroy. The SSL certificate, issued by Amazon RSA 2048 M02, provides HTTPS encryption, a tactic often employed to lend legitimacy to phishing pages. As of the latest assessment, 91jaiho.xyz has been taken offline, likely in response to detection and reporting. However, the elevated risk level persists due to the domain's recent creation and the use of cloud-based hosting, which may facilitate rapid redeployment. Organizations and users are advised to monitor for similar domains leveraging the Jaiho91 branding, particularly those registered through NameSilo or resolving to AWS CloudFront IPs. Proactive blocking of the identified IP and domain, along with SSL certificate fingerprinting, is recommended to mitigate residual threats.