A relay endpoint is the service or infrastructure that receives stolen data from a phishing page and forwards it elsewhere. It may look benign on the surface, but it is part of the theft chain because it moves captured credentials out of the victim-controlled environment.
What a Relay Endpoint Does in the Theft Chain
A relay endpoint is not the phishing page itself, but the downstream service that receives harvested data and passes it onward. That forwarding role matters because it is part of the exfiltration path, turning captured credentials or other stolen inputs into usable theft.
The key security distinction is that the endpoint may appear ordinary to victims and even to casual defenders, while still serving a criminal workflow. In practice, the relay is the handoff point between initial capture and later use, storage, resale, or operator access.
How Relay Endpoints Fit into Phishing Infrastructure
Relay endpoints are usually placed to reduce friction for the phishing operation. They can receive POSTed form data, accept redirected traffic, or ingest submissions from fake login pages, then forward the captured material to another destination controlled by the attacker.
That makes the endpoint part of a chain rather than a standalone artifact. The page that tricks the user, the relay that collects the output, and the final destination that receives it may be separate components, which can complicate tracing, takedown, and attribution.
Because the relay sits between victim interaction and attacker handling, it often becomes the point where logs, headers, and request patterns reveal the broader campaign. A relay endpoint can also be rotated or replaced quickly, which makes continuity more important than any single host or URL.
Why Relay Endpoints Matter to Detection and Response
For defenders, the relay is often more useful than the lure page because it can expose the mechanics of collection and forwarding. Traffic patterns, repeated submission routes, and unexpected outbound handoffs can help show that a site is not merely hosting content but actively moving stolen data.
That is why endpoint monitoring, URL intelligence, and takedown workflows should treat the relay as an operational object, not just a benign middlebox. MITRE ATT&CK Enterprise Matrix is useful here because it helps analysts map the relay to the wider credential-access and exfiltration chain.
Relay endpoints also matter when organisations investigate phishing indicators at scale. A campaign can use one lure and many relays, or many lures and one collector, so the infrastructure relationship can be more informative than any single page snapshot.
Common Misunderstandings About Relay Endpoints
A frequent mistake is to treat the relay as merely passive hosting. In reality, it is usually an active collection and transfer component, and that difference changes how you classify the infrastructure and how you respond to it.
Another misunderstanding is to assume the relay always stores the stolen data locally. Some relays immediately forward the data elsewhere, which means short-lived infrastructure can still be highly consequential even if it appears to leave little residue behind.
The term also overlaps with broader phishing and credential-theft tradecraft, but not every redirector or intermediary is a relay endpoint. The defining feature is the receipt of stolen data and the onward movement of that data as part of the theft workflow.
Risk and Threat Considerations
Relay endpoints increase the resilience of phishing operations because they separate collection from final handling. That separation can delay takedown, obscure attribution, and make it harder to interrupt the theft chain before captured data is reused.
Failure mechanism: If the relay accepts harvested credentials or other stolen inputs and forwards them without strong monitoring or rapid disruption, the attacker preserves a functioning exfiltration path even after the lure page changes.
Impact: Victims can be compromised quickly after submission, defenders may see only fragmentary infrastructure, and responders may lose the chance to recover the full attack path or block downstream abuse in time.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1020 — Data Exfiltration | Relay endpoints forward stolen data as part of exfiltration workflows |
| T1566 — Phishing | Relay endpoints commonly support phishing campaigns that collect victim submissions | |
| Recommendation — Map relay forwarding to exfiltration paths and hunt for collection-to-transfer handoffs. Correlate relay activity with phishing indicators and block related infrastructure. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Monitoring is needed to spot collection and forwarding behaviour on relay infrastructure |
| Recommendation — Instrument monitoring to detect suspicious submission and forwarding patterns. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Relay endpoints are exposed through network traffic patterns and outbound handoffs |
| Recommendation — Use network monitoring to identify suspicious relay and exfiltration behaviour. | ||
| OWASP API Security Top 10 | API6 — Unrestricted Access to Sensitive Business Flows | A relay endpoint can automate sensitive submission flows that move stolen data onward |
| Recommendation — Restrict abusive submission flows that can be repurposed for data relay. | ||
Practitioner Guidance
What to watch for: Treat relay endpoints as part of phishing infrastructure triage, not as neutral hosting artefacts. Repeated submission patterns, unusual outbound forwarding, and short-lived collection endpoints are strong signs that a page is acting as a data relay rather than a static decoy.
Practitioner takeaway: The relay is often where a phishing campaign becomes operationally real, so classify it by its data-handling role, not by its surface appearance.
Related resources from NHI Mgmt Group
- What is the difference between endpoint compromise and management-plane compromise?
- How should security teams reduce NTLM relay risk in Active Directory?
- When should organisations prioritise relay and coercion controls?
- What is the difference between endpoint malware detection and workload identity governance?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org