diwa777[.]xyz

This domain is classified under an elevated risk level for generic phishing activity targeting user credentials or sensitive data. Analysis indicates the infrastructure was designed to mimic legitimate platforms while evading initial detection, a common tactic in credential harvesting campaigns. Infrastructure analysis reveals the domain diwa777.xyz was registered through Gname.com Pte. Ltd. on January 02, 2026, an unusually future-dated creation that may indicate attempts to bypass reputation-based filters. It resolves to IP address 99.84.152.89, hosted on Amazon Web Services with content delivery facilitated by Amazon CloudFront and Amazon S3. The SSL certificate is issued by Amazon, while third-party libraries are loaded via jsDelivr. Security vendors flagged this domain on VirusTotal with 7 out of 95 detections, and it appears on two blocklists: PhishDestroy and OISD. Additional trust scoring systems assign a 0/100 rating, reinforcing its malicious classification. Mitigation against this phishing threat involves immediate blocking of the domain and its associated IP address (99.84.152.89) at the network perimeter. Organizations should enforce strict certificate validation to prevent SSL-based evasion and monitor for connections to Amazon CloudFront or S3 buckets linked to this campaign. End-users should be trained to recognize generic phishing indicators, such as mismatched page titles (Diwa777) and future-dated domain registrations. If credentials were entered on this site, password resets and multi-factor authentication reviews are recommended for affected accounts.