xn--reay-h1a[.]app

The domain xn--reay-h1a.app poses a high risk of generic phishing, specifically impersonating the brand Relay. This domain was created on February 21, 2026, and was taken offline shortly thereafter. It resolves to the IP address 45.141.102.184, which is located in Russia and is associated with AS48347 JSC Mediasoft ekspert. The domain lacks an SSL certificate, which is a common indicator of a non-secure and potentially malicious site.

Analysis indicates that 10 out of 95 security vendors on VirusTotal flag this domain as malicious. The domain is registered through NiceNIC International Group Co., Limited, a registrar that has been associated with various suspicious activities. Furthermore, the domain appears on three security blocklists, including PhishDestroy and SEAL, which adds to the credibility of its threat status. The creation date of February 21, 2026, and the rapid offline status suggest a short-lived, targeted campaign.

If users have visited xn--reay-h1a.app, they should immediately change any passwords or sensitive information that may have been entered on the site. It is recommended to run a full system scan using updated antivirus software to ensure no malware was installed. Additionally, users should monitor their financial and account statements for any unauthorized activity and consider enabling multi-factor authentication on all critical accounts.