oxadatacryptorecovery[.]com

The domain oxadatacryptorecovery.com is currently active and has been classified as a high‑risk brand‑impersonation campaign targeting cryptocurrency‑related services. The site resolves to the IPv4 address 107.173.193.235, which belongs to the HostPapa hosting network (ASN 36352) located in the United States. DNS resolution is provided by ns1.bthostcloud.com and ns2.bthostcloud.com, both of which are typical of shared‑hosting environments. An HTTPS service is presented using a Let’s Encrypt certificate (common name matches the domain, issued to the identifier YE2), indicating that transport encryption is correctly configured but does not mitigate the malicious intent of the content. A HTTP GET request returns status code 200, confirming that the web server is responding normally.

The page title returned by the server reads “Crypto Recovery Services – Recover Lost Wallets & Stolen Funds | OxaData Agency”, which aligns with the declared scam type of a crypto recovery service. The domain was registered on 11 November 2025 through Global Domain Group LLC, a registrar that frequently appears in abuse reports. VirusTotal has recorded detections from seven of ninety‑five scanning engines, providing independent confirmation that the site contains malicious elements. In addition, the domain is listed on three external blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and the SEAL filters, suggesting that multiple security vendors have observed phishing or fraud activity associated with this host.

The intelligence indicates that the campaign employs brand impersonation across an unspecified set of targets, likely leveraging the generic “OxaData Agency” branding to lure victims seeking assistance with lost cryptocurrency wallets. No further technical artifacts such as malicious payload hashes, command‑and‑control endpoints, or phishing form URLs have been disclosed, leaving the exact content and user‑interaction flow uncertain.