assetrecoverysystem[.]org

The domain assetrecoverysystem.org is currently active and is being used to impersonate WhatsApp in a wallet/seed phishing campaign. The site presents the page title "Assets Recovery System – Crypto and Assets Support", which suggests a promise of cryptocurrency recovery. Registration data shows the domain was created on 11 August 2025 through Dynadot LLC. Technical infrastructure points to hosting on HostPapa (AS36352) in the United States, with the domain resolving to IP 198.23.190.194. The web server uses LiteSpeed and serves content over HTTP/3, with a Let’s Encrypt R12 certificate providing TLS encryption.

The HTTP response code is 307, indicating a temporary redirect that may be used to forward victims to malicious payloads. The site runs on WordPress backed by MySQL and PHP, and includes client‑side libraries such as Underscore.js, jQuery and GetButton, which are common in compromised sites. Reputation metrics are extremely low: Gridinsoft assigns a trust score of 21/100, and Scamadviser reports 1/100. VirusTotal records a single detection out of 95 scanning engines, and the domain appears on one public blocklist, currently blocked by PhishDestroy.

These signals collectively confirm a high‑risk profile. Uncertainties remain regarding the exact content delivered after the redirect, the presence of any additional command‑and‑control infrastructure, and whether the site harvests additional credentials beyond wallet seeds. Defenders should immediately add assetrecoverysystem.org to URL filtering and endpoint blocklists, monitor network traffic for connections to 198.23.190.194, and enforce multi‑factor authentication for WhatsApp‑related accounts. Incident response teams should also consider reviewing logs for any attempted access to the domain, and threat‑intel feeds should be updated to reflect this WhatsApp impersonation vector.