rls[.]app-airdropalert[.]cfd

This domain rls.app-airdropalert.cfd was registered on 2026-02-21 and is currently offline. DNS resolution points to 142.250.181.228, an IP owned by Google LLC (AS15169) located in the United States. The hosting infrastructure therefore appears to leverage legitimate Google cloud assets, a tactic frequently used to increase credibility and evade network‑based detection. The site presented a page title of “Google,” matching the declared brand target. The SSL certificate is identified as “WE2,” indicating that TLS was present at the time of collection.

VirusTotal analysis shows 13 of 93 scanning engines flagged the domain as malicious, reflecting a moderate consensus among AV vendors. The domain is listed on one public blocklist and is actively blocked by the PhishDestroy filtering service. Gridinsoft assigned a trust score of 0 out of 100, effectively marking the domain as completely untrusted. The intelligence categorizes the activity as a tech‑support scam, a social‑engineering vector that typically lures victims into granting remote access or paying for unnecessary services.

Because the site is offline, visual content and interaction flow have not been captured, leaving several behavioural indicators unknown. Defenders should ensure that any outbound connections to 142.250.181.228 are examined for anomalous patterns, especially those originating from users accessing Google‑related services. Network‑level controls should block the domain and its resolving IP, and endpoint security solutions should incorporate the VirusTotal detection count as an indicator of compromise. Continuous monitoring of threat‑intel feeds for re‑appearance of the domain or related sub‑domains is recommended, as the use of reputable cloud infrastructure suggests the operators may reactivate the site or shift to new hosts.