justrelay[.]fun

This domain, justrelay.fun, presents a brand impersonation threat targeting Solana users by mimicking a legitimate wallet messenger service. The site displays the page title 'Relay - Solana Wallet Messenger,' suggesting an attempt to deceive users into entering sensitive wallet credentials or private keys under the guise of a trusted communication platform. Such impersonation schemes are commonly used to facilitate cryptocurrency theft by harvesting authentication details from unsuspecting victims. Analysis indicates the domain was registered on March 30, 2026, through GoDaddy.com, LLC, and resolved to the IP address 34.111.179.208, hosted on Google Cloud infrastructure. It appears on one security blocklist and has been referenced in eight threat intelligence pulses on AlienVault OTX, signaling prior detection by security researchers. Despite these indicators, the domain currently shows 0/95 detections on VirusTotal, meaning it has not yet been flagged by most antivirus or URL scanning engines. The SSL certificate is issued by Let's Encrypt, a common but neutral finding, while detected technologies include Node.js, React, Next.js, and Google Cloud CDN, consistent with modern web applications. Users who visited justrelay.fun should assume potential exposure of wallet credentials or other sensitive data. Immediate actions include revoking access to any connected wallets, generating new private keys, and monitoring accounts for unauthorized transactions. If cryptocurrency was transferred to an unknown address, report the incident to the relevant blockchain explorer and consider filing a complaint with local cybercrime authorities. Given the domain’s current offline status, further interaction is unlikely, but vigilance for similar phishing attempts is advised.