joystay[.]in

The domain joystay.in has been identified as a high-risk site involved in credential theft phishing activities. Currently, it is offline. The investigation has found that the domain was used to deceive users into providing sensitive credential information, exploiting the guise of a service branded as 'DPD'. The site's potential threat level is escalated due to its previous operational state and the variety of threat detection measures it has evaded temporarily.

Registered via Endurance International Group India Private Limited, joystay.in was created on May 25, 2025, and resolved to the IP address 192.185.129.195, hosted in the US by HostGator.com LLC. This domain has been flagged by 23 out of 95 security vendors on VirusTotal, indicating a significant recognition as a threat. Moreover, joystay.in appears on one known security blocklist, specifically flagged by PhishDestroy, and is also listed as a phishing site by Google Safe Browsing. The domain had employed an SSL certificate issued by Let's Encrypt, underlining the sophistication in mimicking legitimate sites.

Though currently offline, the inherent risk associated with joystay.in requires vigilance. Users who may have interacted with this domain should immediately conduct security audits to ensure no compromise of their credentials. Companies should update their security filters to block any resurgence of this domain or related infrastructure. Educating users about recognizing such potential threats and conducting more frequent phishing simulations could also mitigate future occurrences.