update-relai[.]app

PhishDestroy identifies update-relai.app (seed: d89736) as an active credential phishing domain currently distributing fake login portals to harvest user credentials. This domain is in active circulation and should be considered a high-risk threat until verified otherwise. update-relai.app, registered on March 04, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, is hosted on IP address 172.67.200.51 with a Let's Encrypt SSL certificate. This domain is flagged by 2 of 95 VirusTotal security vendors, indicating limited but concerning detection. Its recent registration and low blocklist presence suggest a potentially evasive threat actor leveraging newly created infrastructure to avoid prior detection. The domain's naming convention, update-relai.app, implies an attempt to impersonate a legitimate service, likely targeting users in the cryptocurrency or financial services sectors. This domain is classified as an elevated risk due to its active status and the specific threat of credential harvesting. Users should avoid entering any credentials or sensitive information on this domain. Organizations are advised to implement network-level blocking for update-relai.app and its associated IP address (172.67.200.51). Additionally, monitor for any internal connections to this domain and conduct user awareness training to mitigate the risk of credential compromise. PhishDestroy's latest scan confirms this domain as a confirmed phishing site, and users are strongly urged to verify its safety via PhishDestroy before any interaction.