bridge[.]relaylink[.]xyz

This domain bridge.relaylink.xyz has been classified under generic phishing with a high risk level and remains active as of July 12 2026. It resolves to the IPv6 address 2606:4700:3031::6815:5742 located in the United States under AS13335 and employs nameservers keanu.ns.cloudflare.com and luciane.ns.cloudflare.com. The domain was created on April 20 2026 through Dynadot Inc with an SSL certificate issued by Let's Encrypt. Its page title is listed as Relay and the site returns an HTTP status of 200 while using HSTS Cloudflare Browser Insights Cloudflare and HTTP/3. One security blocklist has already recorded the domain and the Gridinsoft trust score registers at 0/100.

VirusTotal reports show six out of ninety-five vendors marking the domain as malicious. Infrastructure analysis reveals consistent use of Cloudflare edge services without additional indicators of brand-specific targeting. The scam type remains recorded strictly as generic phishing. No further details on payload delivery mechanisms or victim selection criteria appear in the current intelligence set.

Defenders should implement DNS and network blocks for bridge.relaylink.xyz and review logs for connections to the associated IPv6 address. Monitoring for additional domains sharing the same nameserver pair or recent registration dates on the same registrar is advised. Uncertainty persists around the precise phishing kit employed or the full scope of campaigns since only aggregate blocklist and vendor flags are available. Continued tracking of the active status through the listed blocklist sources will help confirm persistence or takedown events.