jokervpn[.]app

Analysis of jokervpn.app shows an active generic phishing site hosted on IP 217.177.44.166, a Finnish VDS provider (Vdska FL1). The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves via the authoritative nameservers ns3.my-ndns.com and ns4.my-ndns.com. A valid Let's Encrypt certificate (YE1) is present, and the HTTP response returns status 200. The page title, "JOKER VPN — Один ключ открывает весь мир," is Russian‑language text, suggesting the campaign may target Russian‑speaking users. The site is already listed on at least one security blocklist and has been flagged by PhishDestroy. VirusTotal records indicate that 2 of 91 security vendors have identified the domain as malicious. While the exact phishing content and credential‑harvesting mechanisms have not been disclosed, the observable infrastructure confirms a high‑risk profile. Defenders should block the domain at network and email gateways, monitor DNS queries for the associated IP address, and consider adding the IP to threat‑intel feeds. Ongoing observation is recommended to detect any evolution of the payload or command‑and‑control endpoints.