soft[.]mydiv[.]net

On 24 July 2026 analysts observed that the domain soft.mydiv.net continues to be active and hosts a page titled "Access Verification". The site resolves to IP 108.181.24.29, which belongs to AS40676 Psychz Networks located in the United States. The hosting environment runs Ubuntu behind an Nginx web server, and the TLS certificate is issued by Let’s Encrypt (R12), indicating a valid HTTPS endpoint. The domain was created on 26 April 2007 and is registered through OVH, SAS.

Nameserver records point to Cloudflare’s igor.ns.cloudflare.com and val.ns.cloudflare.com. VirusTotal reports that two out of ninety–three scanning engines flag the domain, confirming a modest detection rate. The site appears on at least one external blocklist and is explicitly blocked by the PhishDestroy service. An HTTP request to the root URL returns a 403 Forbidden status, suggesting that direct access is denied or that the page is intended to be reached only after a prior step.

No additional content analysis is available beyond the page title, and the exact phishing vector has not been publicly disclosed. Given the presence of detections, blocklist inclusion, and the "Access Verification" title, the domain is consistent with credential–harvesting activity. Defenders should add soft.mydiv.net to URL filtering policies, enforce TLS inspection where possible, and monitor outbound traffic for connections to 108.181.24.29. Continuous re–evaluation is advised in case additional malicious payloads are observed.