rls[.]stakingrewards[.]biz

Analysis as of July 23 2026 indicates that the domain rls.stakingrewards.biz is currently offline. The domain was registered on February 21 2026 and is associated with a credential‑phishing campaign that impersonates Google, as indicated by the page title “Google” and the declared brand target. The hosting IP resolves to 172.253.62.104, which belongs to AS15169 Google LLC in the United States, a fact that may be used to lend legitimacy to the malicious site. The TLS certificate presented is identified as “WR2”, which does not correspond to a publicly trusted CA and therefore is likely self‑signed or otherwise untrusted.

Defensive feeds have already taken action: PhishDestroy lists the domain as blocked, and the domain appears on one external security blocklist. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the site. VirusTotal analysis shows that 12 of 93 scanned security vendors flagged the domain, providing independent confirmation of malicious intent. No additional public analysis of the page content is available beyond the title, and the HTTP response code cannot be verified because the site is offline.

Defenders should continue to block the domain at the network perimeter, add the IP address 172.253.62.104 to deny lists, and monitor for any re‑registration of the domain or related sub‑domains. Because the infrastructure leverages a Google‑owned IP range, any future attempts to host similar phishing pages may benefit from the same IP reputation, so ongoing vigilance is advised. The current evidence set strongly supports classifying rls.stakingrewards.biz as a Google credential‑phishing site and treating it as high‑risk.