# PhishDestroy domain threat record: relaysan.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/relaysan.com/
Machine-readable companion: https://phishdestroy.io/domain/relaysan.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 21:34:19 UTC
- Last availability or vendor check: 2026-10-26 00:20:48 UTC
- Stored record updated: 2026-10-26 00:20:48 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: arbitrum

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-19 13:28:53 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a174fb-7366-74fd-baca-b96d6873526d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/relaysan.com
- Certificate Transparency search: https://crt.sh/?q=%25.relaysan.com
- Web Archive lookup: https://web.archive.org/web/*/https://relaysan.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s automated assessment classifies relaysan.com as an impersonation phishing page. The recorded page title is “Crypto payments to your own wallet | RelaySan”, indicating the site markets a crypto‑payment service. PhishDestroy first observed the domain on 2026-10-25, six days after its registration on 2026-10-19. An HTTP GET on 2026-10-25 returned status code 200.

How the scam works
Impersonation phishing copies the branding or naming of legitimate services to lure victims into entering sensitive data such as login credentials, wallet addresses, or private keys. Attackers typically distribute links via email, social media or search results and present a convincing login or payment form. Collected information can be used to access the victim’s crypto accounts or to initiate unauthorized transfers. The classification reflects this risk even though no credential fields were observed on the captured page.

Evidence
VirusTotal scanned the domain on 2026-10-25 and 2026-10-26 with 92 engines each and reported 0 malicious and 0 suspicious detections. Google Safe Browsing checked on 2026-10-26 and did not flag the site. urlscan.io captured the page on 2026-10-25; its engine gave a malicious score of 93 while the overall verdict was non‑malicious. OTX listed four pulses, Spamhaus DBL listed the domain as spam, and PhishDestroy’s internal blocklist includes it, all as of 2026-10-26.

Infrastructure
The domain was registered with NICENIC INTERNATIONAL GROUP CO., LIMITED on 2026-10-19 and expires on 2027-10-19. DNS A records resolve to 188.114.96.3 and 188.114.97.3, and AAAA records to 2a06:98c1:3120::3 and 2a06:98c1:3121::3; the authoritative name servers are elle.ns.cloudflare.com and isaac.ns.cloudflare.com. The site is served through Cloudflare, using a TLS certificate issued by Cloudflare TLS Issuing ECC CA 4, valid from 2026-10-19 to 2027-01-17. The hosting ASN is 13335 (Cloudflare) and DNSSEC is not enabled.

What to do
Users should not enter any crypto wallet credentials, private keys, or approve transactions on this site; if they have already done so, change associated passwords and monitor accounts for unauthorized activity. Organizations should block relaysan.com at firewalls or proxy filters, log any outbound connections to the recorded IPs, and educate users about impersonation phishing targeting crypto services.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a174fb-7366-74fd-baca-b96d6873526d/
Cloudflare Radar report: https://radar.cloudflare.com/scan/887828e8-1fb5-44a2-a704-2b54001eaf40
Stored capture screenshot: https://i.ibb.co/fYnJ5LdK/31dde2cb7e93.png
Cloudflare Radar screenshot (2026-10-25T22:07:05Z): https://screenshots.phishdestroy.io/cf/887828e8-1fb5-44a2-a704-2b54001eaf40.png
VirusTotal report: https://www.virustotal.com/gui/domain/relaysan.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=relaysan.com
Archived copy: https://web.archive.org/web/20261025213526/https://relaysan.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 00:16:13 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/fYnJ5LdK/31dde2cb7e93.png
  Captured: 2026-10-25 21:34:19 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a174fb-7366-74fd-baca-b96d6873526d.png
  Captured: 2026-10-25 21:34:19 UTC
  Source report: https://urlscan.io/result/01a174fb-7366-74fd-baca-b96d6873526d/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/887828e8-1fb5-44a2-a704-2b54001eaf40.png
  Captured: 2026-10-25 22:07:05 UTC
  Source report: https://radar.cloudflare.com/scan/887828e8-1fb5-44a2-a704-2b54001eaf40
  SHA-256: 678a3091e6d87aafef0fd6f635cc447e4e0ffa0aaf3ad8acf8f95617b490c83f

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T21:46:52Z",
        "uuid": "01a174fb-7366-74fd-baca-b96d6873526d",
        "scanned_at": "2026-10-25T21:33:24Z",
        "final_url": "https://relaysan.com/",
        "status": 200,
        "ip": "188.114.96.3",
        "ips": [
            "188.114.96.3"
        ],
        "asns": [
            "13335"
        ],
        "doc_hash": "5ee60bd7b313c05fb4ade03bc94c8b346b48498f72c7ce5995c46b79d64ec792",
        "script_hashes": [
            "d6fdc75f204e6bdefa99b69bf1e6d4ac69b8a364f77929f45c13476b4000f717",
            "3da0f6f41d2cdeeae10dbedf8baee3ec577677d9b9aaa621f8d876fa8b666de4"
        ],
        "globals": [
            "htmx"
        ],
        "storage_keys": [
            "htmx:sessionStorageTest",
            "htmx-current-path-for-history"
        ],
        "tls": {
            "san": [
                "relaysan.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "Cloudflare TLS Issuing ECC CA 4",
            "subject": "relaysan.com",
            "protocol": "QUIC",
            "valid_to": "2027-01-17T17:08:59Z",
            "valid_from": "2026-10-19T17:02:37Z"
        },
        "domain_age_days": 5,
        "apex_age_days": 5,
        "tls_age_days": 6,
        "tls_valid_days": 90,
        "requests": 29,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 93,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T22:07:46Z",
        "uuid": "887828e8-1fb5-44a2-a704-2b54001eaf40",
        "scanned_at": "2026-10-25T22:07:05Z",
        "final_url": "https://relaysan.com/",
        "status": 200,
        "history": [
            {
                "url": "https://relaysan.com/",
                "status": 200
            }
        ],
        "dom_hash": "095846ff4db15157f3986f66de1ab174245fab44d7c3791bf49ea29e4104da6f",
        "doc_hash": "04c41af82aa10e74917b9f7e3b05561fe492e1b44886853e4d067bf576e248e5",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "relaysan.com",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "relaysan.com",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "relaysan.com",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            },
            {
                "name": "relaysan.com",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.96.0",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-19T15:28:53Z",
            "updated": "2026-10-19T15:28:54Z",
            "expires": "2027-10-19T15:28:53Z",
            "nameservers": [
                "ns3.my-ndns.com",
                "ns4.my-ndns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T00:12:29Z",
        "analysis_at": "2026-10-25T21:53:17Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 36
        },
        "reputation": 0,
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-10-19T15:28:53Z",
        "expires": "2027-10-19T15:28:53Z",
        "updated": "2026-10-19T17:40:22Z",
        "first_seen": "2026-10-19T18:13:56Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.41.161"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "elle.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:29a1"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "isaac.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "elle.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.148.57"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::ac43:9439"
            }
        ],
        "dns_at": "2026-10-25T21:59:08Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "relaysan.com"
            ],
            "issuer": "SSL Corporation / Cloudflare TLS Issuing ECC CA 4",
            "serial": "47d9c694f7bc2621109ba8d289c89398",
            "sha256": "5cae083bfb933309791ea6781fcecb2efcbb4a36196c02242d2c4d1a26e582be",
            "subject": "relaysan.com",
            "valid_to": "2027-01-17T17:08:59Z",
            "valid_from": "2026-10-19T17:02:37Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "https://nicenic.com",
            "created": "2026-10-19T15:28:53Z",
            "updated": "2026-10-19T15:28:53Z",
            "expires": "2027-10-19T15:28:53Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "elle.ns.cloudflare.com",
                "isaac.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-10-19T15:28:53Z",
                "registration": "2026-10-19T15:28:53Z",
                "registrar expiration": "2027-10-19T15:28:53Z",
                "last update of RDAP database": "2026-10-19T15:28:53Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T22:03:39Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "relaysan.com"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T21:35:26Z",
            "first": "2026-10-25T21:35:26Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 5648
        },
        "robots_txt": {
            "agents": [
                "*",
                "Amazonbot",
                "Applebot-Extended",
                "Bytespider",
                "CCBot"
            ],
            "present": true
        },
        "social_tags": {
            "title": "Crypto payments to your own wallet | RelaySan",
            "robots": "noindex, nofollow, noarchive"
        },
        "trackers": {
            "requests": 28
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 4,
                "tls": 55,
                "wait": 201,
                "connect": 7,
                "download": 1
            },
            "response_ms": 268
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 16582,
            "co2_grams": 0.0006,
            "cleaner_than": 61
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "173.245.58.110",
                    "host": "elle.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.193.177",
                    "host": "isaac.ns.cloudflare.com"
                }
            ],
            "zone": "relaysan.com"
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "SSL Corporation / Cloudflare TLS Issuing ECC CA 4",
            "subject": "relaysan.com"
        },
        "dns": {
            "A": [
                "188.114.96.3",
                "188.114.97.3"
            ],
            "NS": [
                "isaac.ns.cloudflare.com",
                "elle.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"elle.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418259795, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3120::3",
                "2a06:98c1:3121::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://relaysan.com"
            ]
        },
        "linked_pages": {
            "internal_count": 2
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-10-19T15:28:53Z",
            "updated": "2026-10-19T17:40:22Z",
            "expires": "2027-10-19T15:28:53Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "elle.ns.cloudflare.com",
                "isaac.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=UTF-8"
            }
        }
    }
}
```