join-boblayers[.]live

join-boblayers.live is currently active and classified as a high‑risk Google brand‑impersonation site. The domain resolves to the IP address 172.253.63.138, which is registered to AS15169 Google LLC and geolocated in the United States. HTTP requests receive a 301 redirect, and the TLS certificate presented is issued by Google Trust Services under the WE1 hierarchy, indicating that the adversary is leveraging legitimate Google certificate authority infrastructure. Network analysis shows the domain is served through Cloudflare’s edge network, with nameservers brenda.ns.cloudflare.com and renan.ns.cloudflare.com. The hosting environment advertises support for HTTP/3, confirming modern protocol usage. The page title returned by the server is the URL https://buildonbob-registrations.pages.dev/, and no additional content has been publicly disclosed. The site has been added to two independent phishing blocklists, including PhishDestroy and ScamSniffer, confirming its notoriety within the security community. VirusTotal reports two of ninety‑five scanners flagging the domain, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. While the underlying page content has not been examined, the combination of brand targeting, redirection behavior, and legitimate certificate usage suggests an intent to deceive Google users. Defenders should block join-boblayers.live at the DNS and network layers and monitor outbound connections to the associated IP range. Email gateways should treat any messages containing links to this domain as malicious, and users should be warned against visiting the URL. Continuous surveillance of the domain’s DNS records and certificate transparency logs is recommended to detect any future changes or additional infrastructure deployment.