isharkvpn[.]com

The domain isharkvpn.com is currently flagged as a high‑risk generic phishing site. VirusTotal records indicate that five of ninety‑one AV and URL scanners have raised detections against the domain, demonstrating that a minority of security products have identified malicious behavior. The domain is listed on a single external blocklist and has been actively blocked by the PhishDestroy filtering service, confirming that at least one dedicated anti‑phishing platform recognises it as abusive. Infrastructure analysis shows that the domain is hosted on Cloudflare, as evidenced by the authoritative name servers pedro.ns.cloudflare.com and sasha.ns.cloudflare.com.

DNS resolution points to the IP address 104.21.10.14, which belongs to Cloudflare’s network and masks the underlying web server location. The registrar information reveals that the domain was registered through Namecheap Inc. on 15 August 2022, a date that predates the observed malicious activity and suggests the domain has been in use for several years before being repurposed for phishing. The observed data set does not include a page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts, so the exact content served by the site remains unverified. Likewise, no indicators from Open Threat Exchange or other threat‑intel feeds have been reported.

Consequently, while the presence of vendor detections, blocklist listings, and active blocking by PhishDestroy provide concrete evidence of abuse, the specific tactics employed by the site (e.g., credential‑stealing forms, redirects) are currently unknown. Defenders should add isharkvpn.com to local deny lists, enforce DNS‑level blocking, and monitor outbound traffic for connections to 104.21.10.14. Security teams should also consider sharing the domain hash with threat‑sharing platforms to improve collective visibility.