vorgang-relai[.]app

The domain vorgang-relai.app is identified as a brand impersonation threat targeting Apple users. Analysis indicates the site was designed to deceive visitors into believing they could purchase Bitcoin (BTC) via bank transfer or credit card under the guise of the legitimate Relai App Switzerland. The specific threat involves financial fraud, with the domain actively mimicking Apple’s branding to exploit trust in the company’s ecosystem. Infrastructure analysis reveals the domain was registered on February 28, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 188.114.96.3. The SSL certificate was issued by Let’s Encrypt (serial number E7), a common choice for both legitimate and malicious sites. Security vendors flagged the domain as malicious, with 3 out of 95 VirusTotal engines detecting it. Additionally, the domain appears on one security blocklist, further confirming its elevated risk status. The page title, "Bitcoin kaufen (BTC) via Überweisung/Kreditkarte - Relai App Schweiz," explicitly targets users seeking cryptocurrency transactions, a high-value vector for fraud. As of the latest assessment, vorgang-relai.app has been taken offline, reducing immediate risk to users. However, the infrastructure may remain dormant or resurface under a different domain. Organizations and individuals are advised to block the domain and its associated IP (188.114.96.3) at the network level. Users who interacted with the site should monitor financial accounts for unauthorized transactions and consider revoking any linked payment methods. Security teams should update detection rules to include the domain’s indicators of compromise, such as its SSL certificate serial and registrar details, to prevent future exploitation.