relaydesk[.]helpdeskinld[.]com

Analysis of relaydesk.helpdeskinld.com shows infrastructure consistent with credential‑phishing operations. The domain, created on 09 April 2025 and registered via Hosting Concepts B.V. d/b/a Registrar.eu, resolves to IP address 178.16.53.131, which is owned by AS202412 Omegatech LTD in the Netherlands. The authoritative nameservers are ns1.regery.net, ns2.regery.net and ns3.regery.net. No TLS certificate is presented, indicating the site does not serve encrypted traffic.

The HTTP service is currently offline, which aligns with the “taken offline” status reported by monitoring feeds. Threat intelligence flags the site as a credential‑phishing vector; the page title “Secure Login Verification” is typical of login‑capture pages. VirusTotal scans have returned 7 positive detections out of 95 antivirus engines, and Gridinsoft assigns a trust score of 0 / 100. The domain is listed on at least one public blocklist and has been actively blocked by PhishDestroy, reinforcing its malicious classification.

The elevated risk rating reflects the combination of recent registration, low‑cost hosting, lack of encryption, and multiple vendor detections. Uncertainty remains regarding any active payload or the presence of additional malicious infrastructure, as the site is offline and no further content has been captured. Defenders should continue to block the domain at DNS and proxy layers, monitor the hosting ASN for new subdomains, and consider adding the IP address to threat‑intel feeds. Ongoing observation of the associated nameservers is advised, as they may be reused for future phishing campaigns.