callrescue[.]app

This domain, callrescue.app, is under investigation for high-risk phishing activity targeting users through SMS-based lures. Analysis indicates the site presents itself as a motivational messaging service, as evidenced by the page title 'CallRescue – Daily Motivational SMS.' The domain remains active as of July 12, 2026, and is flagged by multiple security sources, including 23 threat intelligence pulses on AlienVault OTX and two security blocklists. Four out of 95 security vendors on VirusTotal have marked the domain as malicious, though the specific detection logic is not publicly disclosed. Infrastructure analysis reveals the domain resolves to the IP address 104.21.44.10 and employs Cloudflare for content delivery and protection, including HTTP/3 support. The SSL certificate is issued by Google Trust Services, which may contribute to the site's perceived legitimacy despite its malicious classification. Registration details indicate the domain is managed through Cloudflare, Inc., a common tactic to obscure ownership and extend operational longevity. The exact nature of the phishing mechanism remains uncertain due to limited public analysis of the site's content. While the page title suggests a focus on SMS-based communication, there is no confirmed evidence of credential harvesting, malware distribution, or other specific attack vectors. Defenders should treat this domain as high-risk due to its active status, presence on threat intelligence platforms, and association with known phishing indicators. Network-level blocking is recommended, particularly for environments where SMS or messaging-themed social engineering poses a risk. Further investigation into user interactions with the domain is advised to determine the full scope of its malicious activity.