webmail[.]msrecoveryfund[.]com

The domain webmail.msrecoveryfund.com is currently active and returns HTTP 200 responses, indicating that a web service is reachable. Registration records show the domain was created through Unstoppable Domains Inc., a registrar known for offering blockchain‑based name services. The authoritative DNS configuration lists four nameservers (ns1.ultahost.com through ns4.ultahost.com), suggesting the hosting infrastructure is provided by Ultahost. No SSL/TLS certificate information is available, and no Safe Browsing, OTX, or additional reputation signals were supplied in the intelligence feed.

VirusTotal has recorded five detections out of 91 scanned security vendors, confirming that at least a minority of scanners have identified malicious characteristics associated with the domain. The domain is also listed on a single external blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the assessment that it is being used for malicious purposes. The threat type is classified as generic phishing, but the specific brand or service being spoofed has not been disclosed in the available data, leaving the exact lure unknown. Defenders should treat any traffic to or from webmail.msrecoveryfund.com as hostile.

Immediate mitigation steps include adding the domain to network‑level deny lists, updating DNS sinkhole rules, and ensuring endpoint web filters reference the known blocklist entry. Security teams should also monitor for any related subdomains that resolve to the same nameserver set, as the infrastructure suggests the potential for rapid deployment of additional phishing sites. Continuous re‑evaluation is advised, given the low but non‑zero detection rate on VirusTotal and the active status of the domain.