resolvrecovery[.]xyz

This domain, resolvrecovery.xyz, is flagged as an active phishing site specifically designed to impersonate a cryptocurrency recovery claim portal. The threat type is classified as a fake recovery portal, targeting users attempting to reclaim lost or stolen digital assets. As of the latest assessment, the domain remains operational and has not been taken down by the registrar or hosting provider. Infrastructure analysis reveals the domain was registered on June 05, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 64.29.17.1, hosted on Amazon.com, Inc. (AS16509) in the United States. Despite its malicious nature, the domain has not been flagged by any of the 95 vendors on VirusTotal, indicating a potential gap in detection coverage. However, it appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The SSL certificate is issued by Let's Encrypt (YR2), a common tactic used to lend false legitimacy to phishing sites. Current evidence confirms the domain is still active and poses a high risk to users seeking cryptocurrency recovery services. Recommendations include immediate blocking of the domain and IP address at the network level, as well as monitoring for related infrastructure, such as newly registered domains under the same registrar or hosting provider. Users should be advised to verify recovery services through official channels only and avoid interacting with unsolicited recovery portals, particularly those with recently registered domains or unclear ownership details.