wondersharerecoverit[.]com

This domain, wondersharerecoverit.com, is currently active and resolves to 167.148.195.211, an address owned by AS207043 DEDIK SERVICES LIMITED in the Netherlands. The domain was registered on 21 February 2026 through Spaceship, Inc., and uses the authoritative name servers launch1.spaceship.net and launch2.spaceship.net. An HTTP request returns status 200 and presents the default Plesk Obsidian 18.0.74 control‑panel page, indicating that the server is likely a misconfigured hosting instance rather than a purpose‑built phishing landing page. The site lacks an SSL certificate, which may facilitate credential capture over clear‑text connections. Threat intelligence sources have flagged the domain in 50 AlienVault OTX pulses, and VirusTotal records 17 of 93 scanners marking it as malicious. The domain appears on three public blocklists and is already blocked by services such as PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. While the exact phishing lure or targeted brand has not been disclosed, the presence of a generic control‑panel page suggests the operator may host credential‑stealing forms or redirect victims to other malicious sites. Defenders should add the IP address and domain to deny‑list rules, enforce TLS inspection to detect clear‑text credential submission, and monitor for any outbound traffic to the host. Continuous threat‑intel correlation is recommended to capture any emerging indicators tied to this infrastructure.