bridge-relay[.]com

Analysis of bridge-relay.com, registered on February 21 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com, shows that the site was used in a wallet/seed phishing campaign impersonating the brand “across”. The HTTP response returned a page title of “Relay”. The TLS certificate presented the identifier R13, and the hosting IP resolves to 45.134.10.34, which is allocated to Infraly, LLC in the United States under ASN 400529. Reputation services rate the host at a Gridinsoft trust score of 0 out of 100, indicating extreme maliciousness.

VirusTotal scans recorded nine positive detections out of ninety‑three submitted engines, and the domain appears on at least one public blocklist. PhishDestroy has also listed the domain as blocked. Safe Browsing and Open Threat Exchange (OTX) data were not explicitly provided, but the presence on multiple vendor blocklists suggests that the domain would be flagged by those services as well. The site is currently taken offline, which limits immediate observation of payload delivery, yet the infrastructure details remain usable for attribution and mitigation.

Defenders should continue to block the IP 45.134.10.34, add bridge-relay.com to local deny lists, and monitor for any re‑registration attempts. Threat intel teams should correlate the R13 certificate fingerprint with other known campaigns and track any future activity originating from the same registrar or ASN. Because the brand target is “across”, organizations that handle across‑related credentials or wallet seeds should be alerted to the possibility of credential harvesting attempts linked to this domain.