The short answer
If you are hunting a recent Joker IOC URL, the useful answer is that no single URL stays current. Joker is an Android malware family that rotates its command-and-control endpoints on a short cycle, often days. A URL pulled from a blog post last month is usually dead by the time you read it. What holds up is a process: pull fresh indicators from live feeds filtered by the Joker family tag, confirm the sample behind them, then write detection rules that match behavior instead of one hostname.
What Joker is, in plain terms
Joker arrived around 2017 and never really left. Early versions signed victims up for premium-rate SMS subscriptions. Later builds added click fraud, notification interception and staged payloads. Most samples reach a device as a harmless-looking app: a wallpaper pack, a flashlight, a QR scanner. The app does little at first. After install it decrypts a payload hidden in its assets, loads it at runtime, and starts talking to a server.
Google has removed well over a thousand apps carrying Joker code from Play over the years, and the family keeps reappearing under new package names and signing keys. That churn is why IOC lists age badly.
Why the URLs rotate
The operators assume defenders will block domains. So they register cheap ones, use them briefly, then abandon them. Some variants skip a dedicated C2 and push stolen SMS data through a Telegram bot API call. That complicates blocking, because you cannot blacklist a legitimate service without breaking normal traffic. Others use HTTPS to a domain that resolves to bulletproof hosting across a rotating set of netblocks.
Practical takeaway: treat any single URL as a sample, not a rule.
Where recent Joker URLs show up
- ThreatFox on abuse.ch. Filter by the Joker tag and sort by date. New C2 entries land there when analysts submit fresh samples.
- URLhaus, also abuse.ch, for distribution URLs: the links that serve the APK.
- MalwareBazaar for hashes. Grab a SHA-256, then pivot to a sandbox report to see what the sample contacted.
- Open source sandboxes such as Triage, Hybrid Analysis and Joe Sandbox. Search the family name and read the network tab.
- OTX pulses and vendor blogs. Zimperium, Doctor Web and Kaspersky have all published Joker teardowns with indicator tables.
- AndroZoo and Koodous if you want the APK itself and can analyze it in a lab.
Cross-check two sources before you act on anything. Single-source indicators posted to social media are noisy.
How I vet a URL before blocking it
- Confirm the sample. An indicator with no hash behind it is a rumor.
- Check domain age and registration. Fresh hosts with privacy WHOIS fit the pattern, though plenty of harmless domains look the same.
- Read the path and payload. Joker C2 paths tend to be short, generic, and inconsistent with the app's stated purpose.
- Test in a sandbox behind a proxy. Watch the DNS query and the TLS SNI.
- Write a rule that catches the behavior, not just the hostname.
Patterns worth keeping
SMS exfiltration, dynamic dex loading from a decrypted asset, reflection-heavy code, and requests to endpoints that appear in no app store listing. On the network side, look for APK downloads from hosts with no content site, and for POST bodies that look like device metadata plus inbox contents. Those signals outlive any domain.
Mistakes I see
- Blocking the Telegram API outright. You break legitimate apps and give users a reason to route around your controls.
- Copying an IOC list with no dates. An undated list is a coin flip.
- Ignoring the mobile side. Joker lives on phones, so endpoint agents and MDM telemetry matter more than perimeter blocks.
- Treating a takedown as permanent. The same crew returns with new domains and a new package name.
Build the feed pipeline once, tag by family, and the recent part takes care of itself.