bridge[.]relaylink[.]app

The domain bridge.relaylink.app was registered through Tucows Domains Inc on 21 February 2026. The registration is recent and coincides with the appearance of a new malicious site that claims to facilitate cryptocurrency transactions. The domain resolves to the IPv4 address 23.254.225.209, which is allocated to AS54290 (Hostwinds LLC) in the Netherlands. The web server returns HTTP 200 for the landing page, whose title is “Relay Bridge”. The site presents a TLS certificate identified as R13, indicating a publicly trusted certificate but offering no validation of the service’s legitimacy. Nameservers ns1.renewyourname.net and ns2.renewyourname.net, both commonly used by disposable or rapidly‑provisioned domains, are configured for the zone. Multiple security products have flagged the domain. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal records 12 detections out of 95 scanners. The domain is listed on two public blocklists—PhishDestroy and ScamSniffer—both of which categorize it as a cryptocurrency‑related scam. The internal risk rating is high, and the site remains active at the time of analysis. At present, the specific brand or service being spoofed cannot be confirmed; the page does not reference a well‑known exchange or wallet provider. Analysts should therefore treat any traffic to bridge.relaylink.app as hostile and block it at perimeter defenses. Email gateways should flag messages containing this URL, and SOC teams should monitor for credential‑harvesting attempts or malicious payloads linked to the IP address. Continuous re‑evaluation is recommended as additional indicators may surface.