jojobet-mobilden-erisimi[.]live

Analysis on July 20, 2026 indicates that the domain jojobet-mobilden-erisimi.live was registered on July 17, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain is delegated to Cloudflare nameservers armfazh.ns.cloudflare.com and stephane.ns.cloudflare.com and resolves to the IP address 188.114.96.3, which belongs to Cloudflare’s network. The short registration-to‑activation interval (three days) aligns with observed patterns for newly‑created phishing infrastructure. The domain appears on one public blocklist and is actively blocked by the PhishDestroy service. VirusTotal has scanned the domain with 95 AV engines; none reported a detection, but the absence of a detection does not constitute evidence of benign behavior. No public Safe Browsing, OTX, or SSL certificate information is available in the current intelligence set, and no page title or content has been captured, leaving the exact payload and target brand unverified. The available data suggest a high likelihood that the domain is being used for generic phishing, possibly to harvest credentials or financial information, given the recent creation date, Cloudflare hosting, and blocklist presence. Defenders should add the domain to network‑level deny lists, monitor DNS queries for the IP 188.114.96.3, and enforce outbound traffic controls to block HTTP/S traffic to the domain. Continuous re‑scanning with sandbox and URL‑analysis services is recommended to capture any evolving payloads. Until definitive content is observed, the domain should be treated as malicious.