jojobet-mobil-girisler[.]live

Analysis of the domain jojobet-mobil-girisler.live, created on July 17 2026, shows an active generic phishing infrastructure. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 172.67.203.171, which is hosted on Cloudflare’s network as indicated by its authoritative nameservers armfazh.ns.cloudflare.com and stephane.ns.cloudflare.com. The SSL certificate presented is issued by Google Trust Services under the WE1 label, providing a valid TLS handshake that may lend superficial credibility to malicious pages. The domain appears on one security blocklist and is specifically blocked by the PhishDestroy service, confirming that at least one external threat‑intelligence feed has identified it as malicious. VirusTotal records show that the domain was scanned by 95 antivirus and URL‑reputation engines, none of which raised a detection at the time of scanning; however, the absence of detections does not equate to safety and may reflect limited coverage or evasion techniques. Publicly available intelligence does not include details such as page title, HTTP response codes, or Safe Browsing verdicts, leaving the exact content and behavior of the site unverified. Defenders should block network connections to 172.67.203.171 and to the domain itself, enforce DNS filtering that includes the observed blocklist entry, and monitor for any traffic that attempts to resolve or contact the domain. Continuous re‑scanning with multiple URL‑reputation services is recommended to capture any future changes in the site’s payload or hosting configuration.