roomgooglelive[.]network

Analysis of the domain roomgooglelive.network indicates active brand impersonation targeting Google, classified as a high-risk tech support scam. The domain was registered on August 21, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to the IP address 194.246.81.11, hosted on AS216071 (SERVERS TECH FZCO) in the Netherlands. Infrastructure analysis reveals the use of nameservers ns1.vdsina.com, ns2.vdsina.com, ns3.vdsina.com, and ns4.vdsina.com, which may facilitate rapid domain rotation or evasion tactics. The domain presents an HTTP 302 redirect status, suggesting dynamic content delivery or conditional access controls. The page title, 'Проверка доступа' (translated as 'Access Verification'), aligns with known patterns of fraudulent verification pages designed to harvest credentials or deploy social engineering payloads. Detected technologies include PHP, Nginx, and reCAPTCHA, the latter of which may be abused to lend false legitimacy to the scam interface. As of July 12, 2026, the domain remains active and is flagged by 13 of 95 security vendors on VirusTotal, alongside inclusion on one security blocklist. Defenders are advised to treat this domain as malicious and prioritize blocking at the DNS or network level. The Let's Encrypt SSL certificate (R13) does not indicate trustworthiness, as certificates are routinely issued to malicious domains. Given the domain's association with a tech support scam classification, potential victims may encounter fabricated error messages or demands for remote access under the guise of Google support. No evidence currently links this domain to broader phishing kits or campaigns, though its infrastructure warrants continued monitoring for related activity.