# PhishDestroy domain threat record: re-lay.link Content language: English Canonical HTML report: https://phishdestroy.io/domain/re-lay.link/ Machine-readable companion: https://phishdestroy.io/domain/re-lay.link/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 01:28:45 UTC - Last availability or vendor check: 2026-10-23 10:02:00 UTC - Stored record updated: 2026-10-23 18:22:26 UTC - VirusTotal detections in the stored snapshot: 4/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: arbitrum ## Stored infrastructure - Observed IP address: 124.198.132.208 - Registrar in stored WHOIS data: TUCOWS.COM, CO. - Registrar country in stored WHOIS data: KN - Last stored HTTP status: 200 - Registration date (registry RDAP, re-lay.link): 2026-07-28 19:32:06 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16666-bc1c-77c6-b2d6-c5c740b46b29/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/re-lay.link - Certificate Transparency search: https://crt.sh/?q=%25.re-lay.link - Web Archive lookup: https://web.archive.org/web/*/https://re-lay.link/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake system classified re-lay.link as malicious because it appears to impersonate the Relay cross‑chain bridging service. The page was first observed by PhishDestroy on 2026-10-23 and returned HTTP 200 with the recorded title “Relay — Fast cross‑chain bridging across 85+ blockchains”. How the scam works Impersonation pages copy the branding and terminology of a trusted crypto service to trick users into connecting their wallets or entering private keys. Once a wallet is linked, the operator can harvest credentials or request approvals that enable unauthorized transfers. Evidence VirusTotal scanned the domain on 2026-10-22 and reported four detections – one malicious label from CRDF and three suspicious labels from AlphaMountain.ai, Forcepoint ThreatSeeker and Fortinet. Google Safe Browsing checked on 2026-10-23 and did not flag the URL, while urlscan captured the site on 2026-10-23; its engine flagged it as malicious with a 95 score but the overall verdict was clean. External blocklists MetaMask and SEAL listed the domain, Spamhaus DBL categorized it as spam, OTX recorded four pulses referencing it, and PhishDestroy lists the domain internally as malicious. Infrastructure The domain was registered with Tucows Domains Inc. on 2026-07-28, giving it an age of 85 days at detection, and resolves to IP 124.198.132.208 owned by 1337 Services GmbH in the United States. The site presented a Let’s Encrypt TLS certificate valid from 2026-08-26 to 2026-11-24 and uses the nameservers 1-you.njalla.no, 2-can.njalla.in and 3-get.njalla.fo. What to do Users should avoid entering credentials or connecting wallets on re-lay.link; if they have already done so, they should monitor their accounts for unauthorized activity. Security teams should block re-lay.link, add its IP address and TLS certificate fingerprint to monitoring rules, and review logs for any connections to the recorded host. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16666-bc1c-77c6-b2d6-c5c740b46b29/ Cloudflare Radar report: https://radar.cloudflare.com/scan/15c93497-ed6a-4e0d-a7e1-cd6d25067f61 URLQuery report: https://urlquery.net/report/267d62d8-d450-40c3-abf8-69e7678c46e0 Stored capture screenshot: https://i.ibb.co/0VZDFBf8/b85bbbdaa946.png Cloudflare Radar screenshot (2026-10-23T01:33:39Z): https://screenshots.phishdestroy.io/cf/15c93497-ed6a-4e0d-a7e1-cd6d25067f61.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/267d62d8-d450-40c3-abf8-69e7678c46e0.png URLScan screenshot (2026-10-22T09:11:12Z): https://screenshots.phishdestroy.io/us/01a162e0-d681-719a-a4b2-86fb01f9c5e2.png URLScan capture report: https://urlscan.io/result/01a162e0-d681-719a-a4b2-86fb01f9c5e2/ URLScan screenshot (2026-10-22T15:34:00Z): https://screenshots.phishdestroy.io/us/01a1643f-33b4-77ca-a0de-2631a0c62226.png URLScan capture report: https://urlscan.io/result/01a1643f-33b4-77ca-a0de-2631a0c62226/ URLScan screenshot (2026-10-22T19:30:08Z): https://screenshots.phishdestroy.io/us/01a16517-48e0-7239-be89-0f7cdc05410f.png URLScan capture report: https://urlscan.io/result/01a16517-48e0-7239-be89-0f7cdc05410f/ URLScan screenshot (2026-10-23T00:43:46Z): https://screenshots.phishdestroy.io/us/01a16636-a09f-70b9-9761-c19b5dc9482a.png URLScan capture report: https://urlscan.io/result/01a16636-a09f-70b9-9761-c19b5dc9482a/ VirusTotal report: https://www.virustotal.com/gui/domain/re-lay.link Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=re-lay.link Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 03:54:08 UTC ## Stored page captures - Primary capture: https://i.ibb.co/0VZDFBf8/b85bbbdaa946.png Captured: 2026-10-23 01:37:41 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16666-bc1c-77c6-b2d6-c5c740b46b29.png Captured: 2026-10-23 01:37:41 UTC Source report: https://urlscan.io/result/01a16666-bc1c-77c6-b2d6-c5c740b46b29/ - URLScan capture 2: https://urlscan.io/screenshots/01a16636-a09f-70b9-9761-c19b5dc9482a.png Captured: 2026-10-23 01:28:45 UTC Source report: https://urlscan.io/result/01a16666-bc1c-77c6-b2d6-c5c740b46b29/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/15c93497-ed6a-4e0d-a7e1-cd6d25067f61.png Captured: 2026-10-23 01:33:39 UTC Source report: https://radar.cloudflare.com/scan/15c93497-ed6a-4e0d-a7e1-cd6d25067f61 SHA-256: ca7e91b4757b707709c18aa7eeaede414d6957e36a96bf1ead261840f4b626b0 - URLQuery: https://screenshots.phishdestroy.io/uq/267d62d8-d450-40c3-abf8-69e7678c46e0.png Source report: https://urlquery.net/report/267d62d8-d450-40c3-abf8-69e7678c46e0 SHA-256: 6dc84f0d6c2fe7da747c5fda620290c6fc4bf1c3a28942d59074216e7981d895 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a162e0-d681-719a-a4b2-86fb01f9c5e2.png Captured: 2026-10-22 09:11:12 UTC Source report: https://urlscan.io/result/01a162e0-d681-719a-a4b2-86fb01f9c5e2/ SHA-256: c092ad7617322d9c0cd91f9d5bf086ccc8f270e666416f3aa860cc50f71a7a99 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a1643f-33b4-77ca-a0de-2631a0c62226.png Captured: 2026-10-22 15:34:00 UTC Source report: https://urlscan.io/result/01a1643f-33b4-77ca-a0de-2631a0c62226/ SHA-256: c092ad7617322d9c0cd91f9d5bf086ccc8f270e666416f3aa860cc50f71a7a99 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a16517-48e0-7239-be89-0f7cdc05410f.png Captured: 2026-10-22 19:30:08 UTC Source report: https://urlscan.io/result/01a16517-48e0-7239-be89-0f7cdc05410f/ SHA-256: c092ad7617322d9c0cd91f9d5bf086ccc8f270e666416f3aa860cc50f71a7a99 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16636-a09f-70b9-9761-c19b5dc9482a.png Captured: 2026-10-23 00:43:46 UTC Source report: https://urlscan.io/result/01a16636-a09f-70b9-9761-c19b5dc9482a/ SHA-256: c092ad7617322d9c0cd91f9d5bf086ccc8f270e666416f3aa860cc50f71a7a99 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T01:38:56Z", "uuid": "01a16666-bc1c-77c6-b2d6-c5c740b46b29", "scanned_at": "2026-10-23T01:36:19Z", "final_url": "https://re-lay.link/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://re-lay.link/", "from": "http://re-lay.link/", "status": 307 } ], "ip": "124.198.132.208", "domains": [ "assets.relay.link", "r.logr-in.com", "api.relay.link", "fonts.gstatic.com", "region1.google-analytics.com", "api.web3modal.org", "pulse.walletconnect.org", "cdn.logr-in.com", "fonts.googleapis.com", "www.googletagmanager.com" ], "ips": [ "104.18.19.237", "172.66.157.155", "104.198.23.205", "13.32.99.79", "18.244.18.2", "142.251.14.94", "172.67.161.106", "216.239.34.36", "142.251.20.95", "142.251.110.97", "124.198.132.208" ], "asns": [ "13335", "396982", "16509", "15169", "210558" ], "countries": [ "US" ], "link_domains": [ "docs.relay.link", "relay.link", "dashboard.relay.link", "testnets.relay.link", "explorer.chain.relay.link", "status.relay.link", "jobs.ashbyhq.com", "support.relay.link" ], "doc_hash": "b1a608ef416741da00b39166ea2b7bc2134d4cdb0ad79e71024fafd0bb6c6af3", "script_hashes": [ "a3d2af83060fa4bd9f9961d4cfac876b4a2f11af9e5d8643ff1bd3df490c884f", "6cca086e94082e4bf068b37df0975262aae960892417619c2d94b5f27058f428", "159189f6ce9fdcbee1ad0006e6908747ababbfd5c9f17cd3625424b2bd546a33", "b7cce03b8b6dbe0a8b7aa6d6c75d4859ca13efac10d73742ab02b88d4bf41b1a", "b87595b152c027c8c596d01b1a25986b66702be90593bd6fd620f692da7c906f", "aba87f2a53e45ecdc9113fc30387d16e449d1676428cf5f82dd624c1df97d152", "dbb71e6c998d2c0b20055d0483228339bcd0cbfad368d789ed95fd184a78d04c", "0c3d3d7a0245d2194cfded892fdf6c33d75e1f401a782b5e00c5d390a62f22ae", "37ad53101b55249ad1754d469f38ff86cf338860a3bc644975c2c23752c553d8", "866e39cc26e1ef7e73ae2f264082ea823c93fcfe94191eaf02f5e7ccff94743a" ], "globals": [ "gtag", "dataLayer", "google_tag_data", "google_tag_manager", "onYouTubeIframeAPIReady", "gaGlobal", "_lrMutationObserver", "_lr_surl_cb", "__SDKCONFIG__", "__reactRouterVersion", "_lrXMLHttpRequest", "_LRLogger", "_lr_loaded", "_walletConnectCore_clientOne_count", "downloadLogsBlobInBrowser", "_walletConnectCore_clientOne", "_walletConnectCore_clientTwo_count", "_walletConnectCore_clientTwo", "mmsdk", "litPropertyMetadata", "reactiveElementVersions", "litHtmlVersions", "litElementVersions" ], "cookies": [ "_ga", "_ga_KK0D48HVMC", "_lr_hb_-g5kb43%2Frelay-10vxa", "_lr_tabs_-g5kb43%2Frelay-10vxa" ], "storage_keys": [ "wagmi.store", "rk-version", "relay-theme", "__lr_navigation_history_v1", "_lr_id_", "mm-sdk-anon-id", "@appkit/active_caip_network_id", "@appkit/active_namespace", "@appkit/connection_status", "cbwsdk.store" ], "tls": { "san": [ "re-lay.link", "www.re-lay.link" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "re-lay.link", "protocol": "TLS 1.3", "valid_to": "2026-11-24T04:25:08Z", "valid_from": "2026-08-26T04:25:09Z" }, "domain_age_days": 85, "apex_age_days": 85, "tls_age_days": 57, "tls_valid_days": 89, "requests": 86, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 95, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx/1.26.3 (Ubuntu)", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T01:38:58Z", "uuid": "15c93497-ed6a-4e0d-a7e1-cd6d25067f61", "scanned_at": "2026-10-23T01:33:39Z", "final_url": "https://re-lay.link/", "status": 200, "history": [ { "url": "https://re-lay.link/", "status": 200 } ], "dom_hash": "b63b203820a71899b10a1efe42d6e254b2bd7292ac9db35812af7f2bbe2a5ee0", "doc_hash": "b1a608ef416741da00b39166ea2b7bc2134d4cdb0ad79e71024fafd0bb6c6af3", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "re-lay.link", "type": "A", "value": "124.198.132.208" } ], "dnssec_valid": false, "ip": "124.198.132.208", "whois": { "registrar": "Tucows Domains Inc.", "created": "2026-07-28T19:32:06Z", "updated": "2026-08-26T05:19:27Z", "expires": "2027-07-28T19:32:06Z", "nameservers": [ "1-you.njalla.no", "2-can.njalla.in", "3-get.njalla.fo" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T03:48:32Z", "analysis_at": "2026-10-22T13:57:13Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 1, "suspicious": 3, "undetected": 36 }, "detections": { "CRDF": "malicious", "Fortinet": "spam", "alphaMountain.ai": "spam", "Forcepoint ThreatSeeker": "suspicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Spam, Suspicious (alphaMountain.ai)" }, "registrar": "Tucows Domains Inc.", "created": "2026-07-28T19:32:06Z", "expires": "2027-07-28T19:32:06Z", "updated": "2026-08-26T05:19:27Z", "first_seen": "2026-07-29T03:52:47Z", "dns": [ { "ttl": 900, "type": "TXT", "value": "yandex-verification: 72a7117c61baa270" }, { "ttl": 60, "type": "A", "value": "124.198.132.208" }, { "ttl": 21600, "type": "NS", "value": "2-can.njalla.in" }, { "ttl": 3600, "type": "SOA", "rname": "you.can-get-no.info", "value": "1-you.njalla.no" }, { "ttl": 21600, "type": "NS", "value": "3-get.njalla.fo" }, { "ttl": 21600, "type": "NS", "value": "1-you.njalla.no" } ], "dns_at": "2026-10-22T13:57:36Z", "jarm": "27d40d40d00040d00042d43d000000d2e61cae37a985f75ecafb81b33ca523", "cert": { "san": [ "re-lay.link", "www.re-lay.link" ], "issuer": "Let's Encrypt / YE1", "serial": "5850eab968be6b33688615e6fee8ed60f01", "sha256": "305315a47278da530569041c3deafbaee455043d22c96cdc0e2277dd36ff1163", "subject": "re-lay.link", "valid_to": "2026-11-24T04:25:08Z", "valid_from": "2026-08-26T04:25:09Z" }, "whois": { "registrar": "Tucows Domains Inc.", "registrar_iana_id": "69", "registrar_url": "www.tucowsdomains.com", "created": "2026-07-28T19:32:06Z", "updated": "2026-08-26T05:19:27Z", "expires": "2027-07-28T19:32:06Z", "status": [ "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "1-you.njalla.no", "2-can.njalla.in", "3-get.njalla.fo" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited", "client update prohibited" ], "events": { "last changed": "2026-08-26T05:19:26Z", "registration": "2026-07-28T19:32:06Z", "registrar expiration": "2027-07-28T19:32:06Z", "last update of RDAP database": "2026-08-26T05:19:26Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T01:39:20Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "re-lay.link" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-23T01:30:41Z", "first": "2026-10-23T01:30:41Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 2702 }, "robots_txt": { "agents": [ "*", "OAI-SearchBot", "ChatGPT-User", "Claude-SearchBot", "Claude-User" ], "present": true, "llms_txt": true, "sitemaps": [ "https://re-lay.link/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 12 }, "social_tags": { "ogUrl": "https://relaylink.cc/", "title": "Relay — Fast cross-chain bridging across 85+ blockchains", "ogType": "website", "robots": "index, follow", "ogImage": "/img/relay.jpeg", "ogTitle": "Relay — Fast cross-chain bridging across 85+ blockchains", "keywords": "Relay, relay bridge, relay crypto, cross-chain bridging, relay protocol, intent-based bridge, multichain payments, relay API, 85 blockchains, instant bridging, relay app, cross-chain swap", "ogSiteName": "Relay", "description": "Relay is a cross-chain payments network for fast bridging across 85+ blockchains. Learn how relay bridge intent-based transfers work in 2026.", "twitterCard": "summary_large_image", "canonicalUrl": "https://relaylink.cc/", "ogDescription": "Relay is a cross-chain payments network for fast bridging across 85+ blockchains. Learn how relay bridge intent-based transfers work in 2026." }, "trackers": { "requests": 57, "trackers": [ { "name": "Google Tag", "company": "Google", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "Google Analytics", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 2 } ] }, "mixed_content": { "no_sri": [ "https://www.googletagmanager.com/gtag/js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 2, "tls": 96, "wait": 93, "connect": 89, "download": 0 }, "response_ms": 280 }, "tls_connection": { "alpn": "http/1.1", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 22, 80, 443 ] }, "carbon": { "bytes": 6877, "co2_grams": 0.0003, "cleaner_than": 80 }, "dns_server": { "ns": [ { "ip": "95.215.19.5", "host": "3-get.njalla.fo" }, { "ip": "185.193.124.2", "host": "1-you.njalla.no" }, { "ip": "185.193.124.34", "host": "2-can.njalla.in" } ], "zone": "re-lay.link" }, "cookies": { "cookies": [ { "name": "_ga" }, { "name": "_ga_KK0D48HVMC" }, { "name": "_lr_hb_-g5kb43%2Frelay-10vxa", "same_site": "Lax" }, { "name": "_lr_tabs_-g5kb43%2Frelay-10vxa", "same_site": "Lax" } ] }, "location": { "ip": "124.198.132.208", "asn": "210558", "org": "1337 Services GmbH", "city": "New York", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "re-lay.link" }, "dns": { "A": [ "124.198.132.208" ], "NS": [ "3-get.njalla.fo", "2-can.njalla.in", "1-you.njalla.no" ], "SOA": "{\"nsname\": \"1-you.njalla.no\", \"hostmaster\": \"you.can-get-no.info\", \"serial\": 2026100223, \"refresh\": 21600, \"retry\": 7200, \"expire\": 1814400, \"minttl\": 3600}", "TXT": [ "yandex-verification: 72a7117c61baa270" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "124.198.132.208", "family": 4 }, "redirects": { "chain": [ "https://re-lay.link" ] }, "tech_stack": { "technologies": [ "Ubuntu", "Nginx", "lit-html", "lit-element", "Google Analytics", "Google Font API", "PWA", "Open Graph" ] }, "whois": { "registrar": "Tucows Domains Inc.", "created": "2026-07-28T19:32:06Z", "updated": "2026-08-26T05:19:27Z", "expires": "2027-07-28T19:32:06Z", "status": [ "clientUpdateProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "1-you.njalla.no", "2-can.njalla.in", "3-get.njalla.fo" ] }, "headers": { "headers": { "server": "nginx/1.26.3 (Ubuntu)", "content-type": "text/html" } } } } ```