relay-compute-relay[.]com

The domain relay-compute-relay.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently taken offline. DNS resolution points to the IP address 104.21.24.199, which belongs to Cloudflare’s AS13335 and is geolocated in the United States. The authoritative nameservers are quincy.ns.cloudflare.com and zainab.ns.cloudflare.com, indicating the site leveraged Cloudflare’s CDN and edge services. An SSL certificate issued by Google Trust Services under the WE1 branch secures the site, confirming a valid TLS handshake but offering no guarantee of legitimacy. HTTP traffic was observed over HTTP/3, consistent with modern Cloudflare deployments.

Security scanners have flagged the domain: VirusTotal recorded detections from 11 of 95 vendors, and the site appears on two public blocklists. It has been actively blocked by PhishDestroy and ScamSniffer, reinforcing the view that the infrastructure is being used for a generic phishing campaign. The page title returned by the server is "Wallet Connect," suggesting an attempt to impersonate a cryptocurrency wallet connection service, though no further content analysis is available.

Defenders should consider the following mitigations: add the domain and its resolving IP to network deny lists, enforce DNS filtering for known malicious hosts, and monitor for any resurgence of the domain or similar sub‑domains under the same registrar. Given the Cloudflare hosting, any future re‑hosting on the same IP range may inherit the same risk profile; therefore, policies that block or scrutinize traffic from AS13335 for suspicious wallet‑related activity are advisable. Continuous re‑scanning of the domain via multi‑vendor services is recommended to capture any changes in detection scores. Organizations that rely on Wallet Connect integrations should verify the authenticity of any connection endpoints against official lists and educate users about unsolicited wallet‑connection prompts.