resolv-recovery[.]xyz

This domain is classified as high-risk brand impersonation, specifically targeting MetaMask wallet users through credential harvesting and wallet-drain schemes. Analysis indicates resolv-recovery.xyz operates as a fraudulent recovery portal, designed to trick victims into disclosing seed phrases or private keys under the guise of account restoration or security verification. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 09, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to IP address 104.21.79.232, a Cloudflare-hosted endpoint commonly used to obfuscate backend infrastructure. The domain appears on three independent security blocklists and is flagged by 15 of 95 security vendors on VirusTotal, including multiple detections for phishing and brand abuse. Additionally, it has been proactively blocked by three cryptocurrency security platforms, confirming its role in targeted wallet compromise campaigns. To mitigate risk, network defenders should immediately block DNS resolution to resolv-recovery.xyz and its associated IP 104.21.79.232 at perimeter security controls. Endpoint detection rules should be updated to flag any process attempting to connect to this domain, particularly browser-based wallet extensions. Cryptocurrency users should be educated to verify domain authenticity via official documentation only and to never enter seed phrases or private keys on any web interface. Organizations handling digital assets should enforce multi-factor authentication and hardware-based key storage to prevent credential-based compromise originating from such phishing domains.