workspace[.]google[.]com[.]filetransfer[.]cfd

Analysis as of July 24 2026 indicates that the domain workspace.google.com.filetransfer.cfd resolves to the IPv4 address 198.54.115.168, which is registered to AS22612 Namecheap, Inc. in the United States. The domain was registered on February 21 2026 and is currently listed as offline. VirusTotal records show that 14 of 93 security vendors have flagged the domain, confirming malicious intent. The site is classified as a Tech Support Scam that impersonates Google, and it has been added to at least one public blocklist and is actively blocked by the PhishDestroy service.

The TLS certificate presented by the host is issued by Sectigo Public Server Authentication CA DV R36, a standard domain‑validated certificate, which does not provide any indication of legitimate ownership. The only HTTP response observed prior to takedown was a generic “Index of /” page title, providing no further functional insight. The combination of brand impersonation, the tech‑support narrative, and the use of a reputable registrar’s infrastructure aligns with known patterns of credential‑harvesting campaigns targeting Google users. While the offline status limits real‑time observation, the available artifacts confirm that the domain was used to lure victims into believing they required assistance with Google services.

Uncertainty remains regarding the exact payload or phishing pages that may have been delivered, as no additional content was captured before the takedown. Defenders should continue to block both the domain and its associated IP address, propagate the indicator set to endpoint protection and web filtering solutions, and monitor for any newly registered domains that reuse the “workspace.google.com.filetransfer” sub‑domain pattern. Ongoing reconnaissance of Namecheap‑hosted infrastructure and correlation with other tech‑support scam campaigns is recommended to uncover any broader malicious infrastructure.