bobbos[.]cl

bobbos.cl was registered on March 11 2026 and is currently classified as a high‑risk brand‑impersonation site targeting Facebook users. The domain resolves to IP 207.210.83.120, an address assigned to AS263702 in Chile and operated by GRUPO ZGH SPA. The hosting appears to be a standard shared service, as indicated by the use of Let’s Encrypt R12 certificate and the presence of generic nameservers ns01.v2nets.com and ns02.v2nets.com.

The web server returns HTTP 200 and presents a page titled “Individual – Berlin”, a pattern often leveraged to mimic legitimate social‑media profile pages. MX records point to Google’s mail infrastructure (aspmx.l.google.com priority 1) and an additional secondary host, suggesting the domain is capable of receiving email, a common requirement for credential‑harvesting campaigns. The SSL certificate is valid and issued by Let’s Encrypt, providing no immediate trust indicator.

Reputation services flag the domain: VirusTotal reports 12 of 95 security vendors flagging the host, Gridinsoft assigns a trust score of 20 / 100, and the site appears on one public blocklist while being actively blocked by PhishDestroy. AlienVault OTX includes the domain in nine threat‑intelligence pulses, reinforcing the attribution to a social‑media impersonation kit. No additional infrastructure details, such as a backend server version or scripting language, have been disclosed.

Defenders should add 207.210.83.120 and bobbos.cl to network‑level deny lists and ensure email filters block inbound messages from the listed MX hosts. Continuous monitoring of DNS changes for the domain and its nameservers is advised, as the operators may pivot to new IP ranges. Incident response teams should treat any credential submissions to this site as compromised and advise affected users to reset their Facebook passwords immediately.