relaxfig[.]top

relaxfig.top was registered on 2026-03-11 through the Cosmotown registrar and is currently marked offline. DNS resolution points to 192.142.54.88, an address hosted in the Netherlands under AS214036 (Ultahost, Inc.). The authoritative nameservers are ns1.hostcreed.com and ns2.hostcreed.com. The site presents a TLS certificate issued by Let’s Encrypt (R13) and serves content over LiteSpeed with HTTP/3 support.

The only visible page title is “The United States Social Security Administration | SSA”, indicating an attempt to impersonate the U.S. SSA service. VirusTotal analysis shows that 17 of 91 scanned security engines flag the domain as malicious, and it appears on a single external blocklist that is actively used by PhishDestroy. An MX record of priority 0 pointing to “relaxfig.top” is present, which may be an attempt to receive victim communications or a misconfiguration. The risk rating is elevated, reflecting the combination of targeted brand impersonation, confirmed malicious vendor detections, and active blocking by at least one anti‑phishing service.

At this time no additional payload or credential‑harvesting pages have been publicly disclosed, and the exact phishing kit remains unknown. Defenders should add 192.142.54.88 to network deny lists, enforce DNS blocking of relaxfig.top, and monitor for any resurgence of the domain or related sub‑domains. Continuous re‑scanning of the IP and periodic checks of the hosting provider for new malicious content are recommended. Organizations that rely on SSA‑related communications should educate users about unsolicited requests for personal information and confirm that legitimate SSA interactions occur only through official https://www.ssa.gov endpoints.