cryptorecoveryconsultant[.]com

Analysis of cryptorecoveryconsultant.com indicates this domain was actively used for wallet and seed-phishing operations targeting WhatsApp users. Registered on November 9, 2024, through Atak Domain, the site resolved to IP address 198.23.141.202, hosted on AS36352 (HostPapa) in the United States. No SSL certificate was present, increasing exposure to interception. The page title, 'CRYPTO RECOVERY CONSULTANT,' suggests a focus on fraudulent cryptocurrency recovery services, a known vector for credential and seed phrase harvesting.

Security vendor assessments reflect elevated risk: Scamadviser assigned a trust score of 1/100, while Gridinsoft rated it 39/100. Three of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Nameservers ns1.sagaciousdns.com and ns2.sagaciousdns.com have been associated with other phishing infrastructure, though direct attribution to a specific threat actor or campaign remains unconfirmed.

As of July 24, 2026, the domain is offline, but its infrastructure may be reactivated or repurposed. Defenders should monitor for re-emergence on the same IP or nameserver set, particularly in campaigns targeting cryptocurrency users via messaging platforms. No evidence links this domain to broader malware distribution or exploit kit activity. The exact content and user interaction flow of the phishing page are not analysed, but the combination of low trust scores, blocklist inclusion, and absence of encryption supports classification as malicious.