mail[.]recover-phone[.]sbs

This domain, mail.recover-phone.sbs, was registered on July 02, 2026, through Dynadot Inc and remains active as of August 01, 2026. Infrastructure analysis reveals it resolves to the IP address 108.167.146.200 and uses nameservers cns43.webhostbox.net and cns44.webhostbox.net, suggesting shared hosting infrastructure often exploited for phishing campaigns. The domain is classified as a high-risk generic phishing threat, with no specific brand or service explicitly identified in available data, though the subdomain 'mail' and domain name 'recover-phone' imply an attempt to impersonate an account recovery or device tracking service. Detection data indicates the domain is flagged by 10 of 91 security vendors on VirusTotal and appears on two independent security blocklists, including PhishDestroy and OpenPhish.

The absence of additional context, such as page title or brand target, limits further classification of the exact phishing lure employed. However, the domain's structure and naming convention suggest it may target users seeking to recover lost or compromised mobile devices or accounts, a common tactic in credential harvesting schemes. Defenders are advised to treat this domain as malicious and implement network-level blocking for the domain and its resolving IP address.

Monitoring for related subdomains or newly registered domains under the same registrar or hosting provider may help identify additional phishing infrastructure. Given the domain's recent registration and active status, security teams should prioritize alerting users to potential phishing attempts leveraging account recovery or device tracking themes. No SSL or HTTP response data is currently available to assess additional indicators of compromise.