cpcalendars[.]msrecoveryfund[.]com

The domain cpcalendars.msrecoveryfund.com is currently classified as a generic phishing site and exhibits a high risk rating. Infrastructure analysis indicates that the domain resolves to four UltraHost name servers (ns1.ultahost.com, ns2.ultahost.com, ns3.ultahost.com, ns4.ultahost.com) and was registered through Unstoppable Domains Inc., a service often leveraged for fast, low‑cost domain onboarding. HTTP probing returns a 403 status code, suggesting that direct content access is intentionally restricted, a pattern commonly observed in credential‑harvesting infrastructures that rely on hidden endpoints or require specific request parameters. The domain is listed on one public security blocklist and is actively blocked by the PhishDestroy feed, confirming that defensive communities have identified it as malicious.

VirusTotal scans show that five out of ninety‑one antivirus engines flag the domain, providing additional corroboration of its malicious intent despite a modest detection count. No further public reputation scores, SSL certificate details, or Safe Browsing entries are available, leaving the broader host reputation largely unverified. Because the site remains active, defenders should prioritize immediate domain‑level blocking in perimeter firewalls, DNS sinks, and endpoint protection policies.

Continuous monitoring of the associated name servers is advised, as changes could signal the deployment of new phishing pages or command‑and‑control points. Organizations that rely on the Microsoft Recovery Fund brand or related services should educate users about the risk of unsolicited calendar‑related links and enforce strict URL verification practices. Threat intelligence teams are encouraged to enrich this indicator with any future passive DNS, TLS, or content snapshots to improve detection fidelity.