cpanel[.]msrecoveryfund[.]com

Analysis of cpanel.msrecoveryfund.com indicates that the domain is currently active and serves as a phishing vector. The domain resolves to nameservers ns1.ultahost.com through ns4.ultahost.com, a set commonly associated with disposable hosting services. Registration was performed through Unstoppable Domains Inc., a registrar that allows rapid creation of domains without traditional verification. VirusTotal reports that five of ninety‑one scanning engines have flagged the site, suggesting malicious content despite a relatively low detection rate.

An HTTP GET request returns a 200 OK status, confirming that a web service is reachable. The domain is listed on a single security blocklist and has been added to the PhishDestroy blocklist, reinforcing its classification as a malicious phishing site. No additional intelligence such as page title, SSL certificate details, or IP geolocation is available from the current feed. The limited detection footprint means that automated defenses may not yet have a high confidence rating, but the presence on a dedicated phishing blocklist and the multi‑vendor detections warrant immediate mitigation.

Defenders should block the domain at perimeter firewalls, DNS resolvers, and proxy filters, and add it to internal IOC lists. Continuous monitoring of the associated nameservers and any future VirusTotal scans is recommended to capture changes in detection scores or additional payloads. Until further evidence is gathered, the domain should be treated as high‑risk and excluded from user‑initiated connections.