cpcontacts[.]msrecoveryfund[.]com

cpcontacts.msrecoveryfund.com is currently listed as an active malicious site. Registration was performed through Unstoppable Domains Inc., a service that allows domain owners to hide traditional WHOIS information, which hampers attribution. The domain resolves to the authoritative name servers ns1.ultahost.com through ns4.ultahost.com, indicating it is hosted on the Ultahost infrastructure. An HTTP request to the root URL returns a 403 Forbidden status, a pattern often observed when phishing landing pages are served only after specific query parameters or referer checks. As of the report date, the domain remains active and is being actively blocked by the PhishDestroy sinkhole service.

It appears on one public security blocklist, providing an additional layer of protection for organizations that consume blocklist feeds. VirusTotal scans have produced five positive detections out of ninety‑one antivirus engines, confirming that at least a subset of security vendors recognize the domain as malicious. No public page title, SSL certificate details, or content snapshots are available, leaving the exact visual or linguistic lures employed by the site unknown. Consequently, defenders cannot rely on content‑based signatures alone.

The evidence suggests that the domain is being used for generic phishing campaigns, likely targeting users of the “msrecoveryfund.com” brand or similar recovery‑related services. Recommended mitigation steps include adding the domain to network and endpoint deny lists, ensuring URL filtering solutions ingest the blocklist entry, and monitoring DNS queries for the four ultahost.com name servers for abnormal resolution patterns. Continuous re‑scanning with multi‑engine services such as VirusTotal is advised to detect any changes in the detection rate. Organizations should also consider tightening email authentication (DMARC, SPF, DKIM) for the associated brand to reduce the success of spoofed messages that may direct victims to this domain.