relay-bridge[.]icu

This domain, relay-bridge.icu, poses a generic phishing threat. Analysis indicates it is designed to deceive users into disclosing sensitive information, such as login credentials or personal data, through fraudulent web pages. The domain is currently active and may host fake forms, credential harvesters, or redirect chains leading to malicious sites. Users encountering this domain should treat it as high-risk and avoid any interaction.

Evidence from intelligence sources shows that VirusTotal has flagged this domain with 3 out of 95 security vendors detecting it as malicious, indicating low but notable detection coverage. The domain was registered on June 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for minimal verification processes. It resolves to IP address 104.21.8.204, which is associated with Cloudflare infrastructure, allowing the threat actor to mask the true hosting origin. The domain remains active as of the latest check, with no current blocklist entries beyond the VirusTotal detections.

If a user has visited relay-bridge.icu, they should immediately disconnect from the internet and run a full antivirus scan on their device. Change any credentials that may have been entered on the domain, and enable multi-factor authentication on affected accounts. Monitor financial accounts and credit reports for unauthorized activity. Report the domain to relevant cybersecurity authorities and block it at the network perimeter to prevent future access.