# PhishDestroy domain threat record: 121z3.ralind.at

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/121z3.ralind.at/
Machine-readable companion: https://phishdestroy.io/domain/121z3.ralind.at/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-27 03:23:28 UTC
- Last availability or vendor check: 2026-10-22 10:06:51 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 15/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: blockchain

## Stored infrastructure

- Observed IP address: 31.59.121.53
- Registrar in stored WHOIS data: helloly GmbH ( https://nic.at/registrar/743 )
- Registrar country in stored WHOIS data: AUSTRIA
- Last stored HTTP status: 301

## Evidence links

- URLScan report: https://urlscan.io/result/01a0e0e6-bb7e-77df-8063-96512f7dba10/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/121z3.ralind.at
- Certificate Transparency search: https://crt.sh/?q=%25.121z3.ralind.at
- Web Archive lookup: https://web.archive.org/web/*/https://121z3.ralind.at/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
121z3.ralind.at is a phishing page that impersonates the Blockchain wallet brand under the title "Blockchain Payout Notification." It targets crypto holders who can be persuaded that money is waiting for them. PhishDestroy first saw it on 2026-09-27. When checked on 2026-10-19 the site was still alive and served a redirect, so it remains a live risk.

How the scam works
A "payout notification" lure tells the visitor that a reward, refund or balance release is ready and only needs to be claimed. Pages like this usually push the victim to sign in with Blockchain wallet credentials, enter a recovery phrase to "verify" ownership, or pay a small processing fee before the payout is released. Each path ends the same way: the operators take over the wallet or keep the fee, and no payout exists. Because Blockchain is a familiar name, the fake notice can look plausible to anyone who has used the real service.

Evidence
On 2026-10-07, 15 of 92 VirusTotal engines flagged the domain, including BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, alphaMountain.ai, CRDF and CyRadar. That is a solid spread of established security vendors, so the domain is broadly recognized as malicious. urlscan.io returned a malicious verdict and detected the Blockchain brand on the page. Spamhaus lists the domain in its DBL as phishing, and it is on the PhishDestroy blocklist.

Infrastructure
The domain is a subdomain of ralind.at, an Austrian name registered through helloly GmbH. It resolves to an address announced by AS56971 CGI GLOBAL LIMITED, a Hong Kong network, with the server located in France. The Let's Encrypt certificate gives the page a padlock in the browser, but that only shows the connection is encrypted. It says nothing about whether the site is genuine.

What to do
If you entered your Blockchain wallet password, change it immediately and reset two-factor authentication from the genuine app. If you typed in a recovery phrase, treat that wallet as compromised and move any remaining funds to a new wallet created with a fresh phrase. If you paid a "fee" to unlock a payout, report it to your payment provider and local police, and expect follow-up messages promising recovery for another fee. Defenders should block the full ralind.at domain at DNS and the mail gateway, and search logs for users who clicked through.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0e0e6-bb7e-77df-8063-96512f7dba10/
VirusTotal report: https://www.virustotal.com/gui/domain/121z3.ralind.at
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=121z3.ralind.at
Archived copy: https://web.archive.org/web/20260927032529/https://121z3.ralind.at/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:09 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/QvkK3CxR/72d7c20f4ffe.png
  Captured: 2026-09-27 03:27:40 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0e0e6-bb7e-77df-8063-96512f7dba10.png
  Captured: 2026-09-27 03:27:40 UTC
  Source report: https://urlscan.io/result/01a0e0e6-bb7e-77df-8063-96512f7dba10/
- URLScan capture 2: https://urlscan.io/screenshots/01a0e062-33e3-7490-8566-18e16820a097.png
  Captured: 2026-09-27 03:23:28 UTC
  Source report: https://urlscan.io/result/01a0e0e6-bb7e-77df-8063-96512f7dba10/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4b48e3cb-d407-4105-aed0-f2e71be65125.png
  Captured: 2026-09-27 03:25:52 UTC
  Source report: https://radar.cloudflare.com/scan/4b48e3cb-d407-4105-aed0-f2e71be65125
  SHA-256: 935028bafaad4c1e24ba46156bb71738a0f7a5696a470d41937dc8cf2b4da172
- URLQuery: https://screenshots.phishdestroy.io/uq/56d3f1fc-46a7-498b-bff0-63edacbe2055.png
  Source report: https://urlquery.net/report/56d3f1fc-46a7-498b-bff0-63edacbe2055
  SHA-256: 1f0a7d75f3310b22aa0214b814d7a009022641effee0ef89cd90938f8af0b851
- URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a115dd-f69a-708f-8092-85ffc7dcc1ee.png
  Captured: 2026-10-07 10:17:19 UTC
  Source report: https://urlscan.io/result/01a115dd-f69a-708f-8092-85ffc7dcc1ee/
  SHA-256: 9b127c908b46ffd0cebf941a00e2639c22b0b47d9f1ab55e8761a906c194975b
- URLScan · 2026-10-07: https://screenshots.phishdestroy.io/us/01a1164d-3ede-75ff-9410-3d5c35cc0e8c.png
  Captured: 2026-10-07 12:18:50 UTC
  Source report: https://urlscan.io/result/01a1164d-3ede-75ff-9410-3d5c35cc0e8c/
  SHA-256: 611baa0eb0f6be72f1808bf65b2d95c0702befb6b5c00f4e183e6c43799444fc
- URLScan · 2026-10-08: https://screenshots.phishdestroy.io/us/01a11bd7-4318-73fb-bcea-5e2957e2d40e.png
  Captured: 2026-10-08 14:07:43 UTC
  Source report: https://urlscan.io/result/01a11bd7-4318-73fb-bcea-5e2957e2d40e/
  SHA-256: 4fc068f980dde7f53f6efad32ab49c4beffa89b02336f1d8ec57e204507a55ca
- URLScan · 2026-10-08: https://screenshots.phishdestroy.io/us/01a11bf4-ff4b-70e5-8d28-dd660c151118.png
  Captured: 2026-10-08 14:40:10 UTC
  Source report: https://urlscan.io/result/01a11bf4-ff4b-70e5-8d28-dd660c151118/
  SHA-256: 4c61044cb10bd1dbea51c9e96f24a225ca41a61327a5bbbcce11a7629a4e0214
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a12644-b7ca-701a-adaf-15ac232b5282.png
  Captured: 2026-10-10 14:43:26 UTC
  Source report: https://urlscan.io/result/01a12644-b7ca-701a-adaf-15ac232b5282/
  SHA-256: 4a2f16fa547644b1e6b31f67e2442f9ee899d766176ee8ab7d9a42678d1ac51a
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15e92-8741-726b-9914-d75efe819e35.png
  Captured: 2026-10-21 13:07:09 UTC
  Source report: https://urlscan.io/result/01a15e92-8741-726b-9914-d75efe819e35/
  SHA-256: 3cfbd9f3149adf70bf62f944c4c3756586f372830f8f79b2f61cb2380cd53916

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:56:32Z",
        "uuid": "01a0e0e6-bb7e-77df-8063-96512f7dba10",
        "scanned_at": "2026-09-27T03:26:59Z",
        "final_url": "https://121z3.ralind.at/trs/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://121z3.ralind.at/trs",
                "from": "http://121z3.ralind.at/trs",
                "status": 307
            },
            {
                "to": "http://121z3.ralind.at/trs/",
                "from": "https://121z3.ralind.at/trs",
                "status": 301
            },
            {
                "to": "https://121z3.ralind.at/trs/",
                "from": "http://121z3.ralind.at/trs/",
                "status": 307
            }
        ],
        "ip": "31.59.121.53",
        "domains": [
            "cdn.jsdelivr.net",
            "cdn.tailwindcss.com"
        ],
        "ips": [
            "104.17.207.5",
            "2606:4700::6811:d005",
            "2606:4700:20::681a:28f",
            "31.59.121.53"
        ],
        "asns": [
            "13335",
            "56971"
        ],
        "countries": [
            "US",
            "FR"
        ],
        "doc_hash": "2c60f4a5e44f0c0d0ef5c0023201f38d3334f7b3f73bbdc4178060f4a41cf20f",
        "script_hashes": [
            "08fd87d46286ff16b870aa23975cb5051bc7c116fa4d88482bb8de3b95261d24",
            "dcf10a2cb8c66e9073c172543bcbd5c903e29ae91a5beca9238a5e93d2f6b056"
        ],
        "globals": [
            "requestResize",
            "page_id",
            "CRedirectName",
            "redirectLastPage",
            "cookee_page_id",
            "cookee_pages",
            "pages",
            "setCookie",
            "readCookie",
            "setPageCookie",
            "readPageCookie",
            "redirectPage",
            "load",
            "init",
            "tailwind",
            "/template.html",
            "supportText2",
            "getCurrentTime",
            "addMessage",
            "typeSupportMessage",
            "saveChatState",
            "loadChatState",
            "renderChatFromState",
            "showInputArea",
            "hideInputArea",
            "showYesNoButtons",
            "hideYesNoButtons",
            "startChat",
            "navigateForward2",
            "openChatBtn",
            "chatModal",
            "closeChatBtn",
            "sendBtn",
            "finishBtn",
            "chatMessages",
            "chatInput",
            "inputArea",
            "yesNoButtons",
            "yesBtn",
            "noBtn"
        ],
        "storage_keys": [
            "page_id_mirntk_blockpay2",
            "pages"
        ],
        "tls": {
            "san": [
                "121z3.ralind.at",
                "www.121z3.ralind.at"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "121z3.ralind.at",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-24T08:37:23Z",
            "valid_from": "2026-09-25T08:37:24Z"
        },
        "domain_age_days": 16,
        "apex_age_days": 179,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 12,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 95,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "blockchain"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Blockchain"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:04:46Z",
        "uuid": "4b48e3cb-d407-4105-aed0-f2e71be65125",
        "scanned_at": "2026-09-27T03:25:52Z",
        "final_url": "https://121z3.ralind.at/",
        "status": 200,
        "history": [
            {
                "url": "https://121z3.ralind.at/",
                "status": 200
            }
        ],
        "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e",
        "doc_hash": "5f04ae9ed6a865bb382c66ef4bd4e57df4ce19d4142b8c87ac40d65ae54d278f",
        "phishing_v2": [
            "phishing"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "121z3.ralind.at",
                "type": "A",
                "value": "31.59.121.53"
            }
        ],
        "dnssec_valid": false,
        "ip": "31.59.121.53",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "helloly GmbH ( https://nic.at/registrar/743 )",
            "updated": "2026-04-15T12:52:13Z",
            "nameservers": [
                "a.dnspod.com",
                "c.dnspod.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:46:14Z",
        "analysis_at": "2026-10-21T15:10:39Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 14,
            "suspicious": 1,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "spam",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "helloly GmbH ( https://nic.at/registrar/743 )",
        "first_seen": "2026-09-25T10:28:43Z",
        "dns": [
            {
                "ttl": 600,
                "type": "A",
                "value": "31.59.121.53"
            }
        ],
        "dns_at": "2026-10-21T15:10:58Z",
        "jarm": "3fd3fd0003fd3fd00042d42d00000000f78d2dc0ce6e5bbc5b8149a4872356",
        "cert": {
            "san": [
                "121z3.ralind.at",
                "www.121z3.ralind.at"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "5278b2e2732019e252e015d23c3ff398595",
            "sha256": "3c62416753e549b14c67c1f7f702bc7629eef1c5fa9846287cd23b160758dad2",
            "subject": "121z3.ralind.at",
            "valid_to": "2026-12-24T08:37:23Z",
            "valid_from": "2026-09-25T08:37:24Z"
        },
        "whois": {
            "registrar": "helloly GmbH ( https://nic.at/registrar/743 )"
        }
    }
}
```