joka-online-casino-login[.]com

Analysis of joka-online-casino-login.com indicates a confirmed credential phishing operation targeting online casino users, specifically leveraging the JokaRoom Vip brand as identified in the page title. The domain was registered on April 24, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the use of Cloudflare nameservers (adelaide.ns.cloudflare.com and alaric.ns.cloudflare.com) and resolution to IP 104.21.90.193, a Cloudflare-hosted address in Canada. The site employs a stack including Strapi, Node.js, React, Next.js, and Express, alongside Cloudflare Browser Insights and HSTS, suggesting an attempt to appear legitimate while masking backend infrastructure. The domain is flagged by one security blocklist (PhishDestroy) and has been classified under the 'Gambler Scam' phishing kit, a pattern commonly used to harvest login credentials from gambling platforms. Scamadviser and Gridinsoft both assign a trust score of 1/100 and 0/100, respectively, reinforcing its high-risk classification. While no detections were reported by the 94 vendors in the most recent scan, this absence does not confirm safety, as phishing domains often evade detection during early deployment. The HTTP 403 status suggests the site may be restricting access to evade automated analysis or limiting exposure to targeted victims. Defenders should treat this domain as an active threat. Indicators such as the recent registration date, Cloudflare obfuscation, and association with a known phishing kit warrant immediate blocking at the DNS or network level. Organizations should monitor for credential submissions or redirects to this domain, particularly in regions where JokaRoom Vip operates. Further analysis of the site's content is required to determine the exact lure mechanism, but current evidence supports its classification as a credential phishing site targeting online casino users.