billyspopsicles[.]com

This domain, billyspopsicles.com, is flagged as an active tech support scam impersonating Google, based on infrastructure and threat intelligence analysis. Registered on June 28, 2025, through Porkbun LLC, the domain resolves to 142.250.74.206, an IP address hosted on AS15169 under Google LLC in the United States. The HTTP response code is 302, indicating a redirect, while the SSL certificate is issued by Let's Encrypt with the serial R13. The page title is reported as 'Billys,' though the exact content of the site has not been analyzed for visual or functional mimicry of the targeted brand. Infrastructure analysis reveals the use of Google Sites and HTTP/3, technologies consistent with modern phishing campaigns seeking to blend into legitimate traffic. The domain appears on two security blocklists and is actively blocked by at least two threat intelligence platforms. One out of 95 security vendors on VirusTotal has flagged the domain, though this limited detection does not diminish the risk given corroborating evidence. Nameservers are hosted under Porkbun (curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com, maceio.ns.porkbun.com, salvador.ns.porkbun.com), a pattern observed in other impersonation schemes. The domain’s association with a known scam type—tech support—aligns with the targeting of Google, though the specific tactics employed remain unconfirmed without deeper content analysis. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. While the domain remains active as of July 12, 2026, defenders should treat it as a confirmed threat vector. Network-level blocking of the IP and domain, along with monitoring for related subdomains or redirects, is recommended. Additional scrutiny of Let’s Encrypt certificates with similar issuance patterns may help identify connected infrastructure.