# PhishDestroy threat dossier — fr-relay-tracking.com ================================================================ Fetched: 2026-06-23 05:09:41 UTC Canonical: https://phishdestroy.io/domain/fr-relay-tracking.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 22/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, BitDefender, Chong Lua Dao, Cluster25, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safebrowsing, Kaspersky, LevelBlue, Lionic, MalwareURL, Mimecast, OpenPhish, SafeToOpen, Seclookup, SOCRadar, Sophos, VIPRE, Webroot URLQuery: 2 detections AlienVault OTX: 1 pulses (threat-intel feed mentions) Public blocklists: listed on 1 independent blocklist Google Safe Browsing: FLAGGED ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 15.237.176.131 (FR, Paris) Hosting org: AS16509 Amazon.com, Inc. Registrar: Squarespace Domains II LLC Nameservers: nse1.squarespacedns.com, nse2.squarespacedns.com, nse3.squarespacedns.com, nse4.squarespacedns.com Registered: 2026-06-14 Expires: 2027-06-14 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-14 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-22 12:07:37 UTC (by PhishDestroy tracker) First reported: 2026-06-22 10:11:29 UTC (abuse notice filed) Last verified: 2026-06-23 04:20:36 UTC Neutralised: 2026-06-22 12:17:27 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019eeecb-4409-740b-a060-6adf81e5ab47/ URLQuery: https://urlquery.net/report/ac6956a7-c2dd-4a3a-9d31-c5cb0dd38f67 Wayback Machine: https://web.archive.org/web/*/fr-relay-tracking.com crt.sh CT logs: https://crt.sh/?q=%25.fr-relay-tracking.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=fr-relay-tracking.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/fr-relay-tracking.com URLhaus: https://urlhaus.abuse.ch/host/fr-relay-tracking.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-22 23:02:07 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] fr-relay-tracking.com is a phishing domain that has been flagged by 22 out of 91 vendors on VirusTotal, indicating a significant level of malicious activity. The domain was registered through Squarespace Domains II LLC and hosted on an IP address managed by Amazon.com, Inc. in France. Despite its recent creation on June 14, 2026, it was swiftly detected by PhishDestroy on June 22, 2026, and subsequently taken offline. The domain's quick detection and takedown highlight the effectiveness of real-time monitoring systems. With a platform risk score of 98 out of 100, fr-relay-tracking.com posed a high threat level during its brief active period. Google Safe Browsing also flagged it, adding another layer of verification to its malicious nature. The domain's presence on two public blocklists, including PhishDestroy and OpenPhish, further underscores its notoriety in the cybersecurity community. The hosting IP address, 15.237.176.131, associated with Amazon's infrastructure, suggests that the attackers leveraged reputable hosting services to lend credibility to their phishing operations. The domain's swift takedown reflects the collaborative efforts between domain registrars, hosting providers, and cybersecurity platforms to mitigate threats. This case demonstrates the importance of rapid detection and response to emerging phishing domains, preventing potential harm to users. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260622-53647E ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/fr-relay-tracking.com/ JSON API: https://api.destroy.tools/v1/check?domain=fr-relay-tracking.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 168,292 domains (12,920 alive under monitoring, 155,053 confirmed takedowns/dead). Site: https://phishdestroy.io