joshyote[.]lol

Analysis of the domain joshyote.lol confirms its classification as a phishing site, currently offline but previously exhibiting multiple high-risk indicators. Registered on March 16, 2026, through Global Domain Group LLC, the domain resolves to IP address 172.67.192.105, hosted by Cloudflare in California. Infrastructure analysis reveals the use of Cloudflare nameservers (harlee.ns.cloudflare.com and jason.ns.cloudflare.com), Cloudflare Browser Insights, HTTP/3, and HSTS—common among both legitimate and malicious sites leveraging Cloudflare’s CDN for obfuscation. The SSL certificate, issued by Let’s Encrypt (serial E7), provides encryption but offers no assurance of legitimacy, as phishing sites frequently use valid certificates to appear trustworthy.

The domain’s page title, 'Loading…,' suggests an incomplete or placeholder state, a tactic occasionally used to evade automated detection during setup or to mask the final malicious payload. While the exact nature of the phishing scheme remains unconfirmed due to the site’s offline status, the domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. Four of 95 security vendors on VirusTotal flagged the domain, though the absence of additional context limits the interpretation of this detection rate.

Defenders should treat joshyote.lol as a confirmed malicious domain, particularly given its presence on multiple blocklists and association with known phishing mitigation tools. The use of Cloudflare infrastructure does not mitigate risk; organizations should ensure endpoint protection, email filtering, and network-level blocking remain updated to prevent exposure. Given the domain’s recent creation and rapid inclusion on blocklists, monitoring for related domains or IP reuse under Cloudflare’s network is recommended.