체인패트롤
Web-Check 
SOCRadar 
LeakIX 
도메인 보안 및 위협 인텔리전스
investment-recovery-services[.]com
“Investment Recovery Service - Get your money back.”
위협 평결
높음
66/100 증거 점수
가용성
서버 오류
최근에 저장된 응답이 결론에 이르지 못했습니다.
위험 신호
VirusTotal 탐지: 4/91
Spamhaus DBL: DBL_SPAM
URLQuery threat systems: 1 alert
브랜드 사칭: Across
보고서 요약
investment-recovery-services.com — 서버 오류 (HTTP 502). 브랜드 사칭: Across; 사기 유형: Wallet/seed Phishing. 증거 요약: VirusTotal 4/91 (alphaMountain.ai, CRDF, Fortinet, Gridinsoft); URLQuery 1 alert; Spamhaus DBL_SPAM; PhishDestroy score 66/100. 등록기관: NiceNIC.
원본 포렌식 기록을 보존하기 위해 아래의 상세 PhishDestroy AI 분석은 영어로 유지됩니다.
증거 요약
HIGH
This domain, investment-recovery-services.com, poses a specific threat of credential theft. It impersonates a legitimate investment recovery service, aiming to collect sensitive personal and financial information from users who have previously lost money in investment scams. The page title 'Investment Recovery Service - Get your money back.' is a classic lure to exploit victims seeking to recover lost funds. The domain's infrastructure is designed to appear trustworthy but is entirely fraudulent, with no legitimate recovery operations behind it.
Analysis reveals strong technical indicators of malicious intent. VirusTotal reports 5 out of 95 security vendors flagging this domain as malicious, indicating broad recognition by the security community. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to IP address 185.181.165.238 and appears on 1 security blocklist. The Gridinsoft trust score is 0 out of 100, confirming near-zero trustworthiness. The domain is currently taken offline, but its history shows it was actively used for phishing operations.
Users who visited this domain should immediately change passwords for any accounts where credentials may have been entered. If financial information was submitted, contact the bank or credit card issuer to monitor for fraud. Run a full antivirus scan on any devices used to access the site. Report the incident to local cybercrime authorities. Avoid entering any personal data on unsolicited recovery service websites, and verify such services through official regulatory channels.
VirusTotal
4 det.
URLQuery
1 threat alert
DNS Security
3/14
URLScan
TLS 인증서
만료되었거나 검증되지 않음
관측 상태
서버 오류 502
DestroyList
등록됨
Reports Sent
1
데이터 적용 범위
VirusTotal
4 / 91
URLQuery
1 threat-system alert
PhishStats
확인되지 않음
OTX
no community references
CF 레이더
scan completed
URLScan capture
저장된 보고서
URLScan verdict
판정 없음
DNS 차단
3/14
TLS
만료되었거나 검증되지 않음
WHOIS
not parsed
스크린샷
3 captures · 3 sources
리디렉션 체인
조사되지 않음
네트워크 보안 인텔리전스 Registrar context
DNS Provider Blocks
3 / 14
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| DNS4EU | investment-recovery-services.com |
malicious | Sinkholed |
Registrar context
NiceNIC
Stored registration data identifies NICENIC INTERNATIONAL GROUP CO., LIMITED (IANA 3765) as the registrar. PhishDestroy maintains separate NiceNIC abuse-report research; registrar association is contextual and is not an independent detection for this domain.
SSL Certificate
Invalid
SSL certificate is invalid or expired. Issuer:
위협 대응 Pipeline
발견
Checks
Reports
가용성
14/15
Sent Report Recorded
Stored sent-report record for registrar NiceNIC International Group Co., Limited, hosting provider, 3 abuse contacts
abuse@s-host.com.uaabuse@nicenic.nethttp://whois.nicenic.com/?page=whoisform
공개 차단 목록 상태
저장된 캡처
도메인 인텔리전스
도메인
서버 / ASN
Apache · AS50673 Serverius
IP 평판
abuse score 0/100 0 reports checked 2026년 8월 1일
등록기관
NiceNIC
(RU)
PhishDestroy Investigation
(RU)
PhishDestroy Investigation
등록 정보Expires 2027년 2월 12일
HTTP 상태502 Error
기술적 세부 사항DNS, SSL SAN, 타임스탬프
최초 발견2026년 2월 16일
DOM Analysisanalyzed 2026년 8월 1일score 0/1004 brand signals
IoC Extractionscanned 2026년 8월 1일0 wallet · 0 Telegram IoCs
Submitted URLhttps://investment-recovery-services.com/
네임서버ns4.offsh.nl
TLS Fingerprint
TLS Observationvalid from 2026년 2월 16일scanned 2026년 3월 15일
TLS SAN Domainswww.investment-recovery-services.com
Case ID
ICANN OVERSIGHT
인증 및 RAA 상황
인증 및 RAA 상황
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
인증은 계약이지, 안전 보증 마크가 아닙니다.
ICANN 수수료 확인
RAA §3.18 읽기
PHISHDESTROY INVESTIGATIONICANN funding, contracts, and DNS abuse oversight
Latest Classified Outcome 2026-08-20 02:42:29 UTC
Primary outcome
알 수 없음
reason: Origin unreachable 20% confidence
Attribution
mechanism: Http 5xx source: Current Http Probe
Evidence layers
Availability: Unreachable
Content: Unknown
DNS: Timeout
Registration: Active
Latest HTTP observation
알 수 없음 Origin unreachable Http 5xx 20% 2026-08-20 02:42:29 UTC
RDAP registration
활성 NICENIC INTERNATIONAL GROUP CO., LIMITED · IANA 3765 RDAP HTTP 200 source: Rdap Status Collector clientDeleteProhibitedclientTransferProhibited expires 2027-02-12 19:40:37 UTC checked 2026-08-05 18:46:06 UTC
Observed timeline
last reachable: 2026-08-19 22:15:47 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
사용 기술 · 3 identified
B
Bootstrap
UI frameworks
Popular CSS framework for responsive, mobile-first web development.
A
Apache HTTP Server
Web servers
Most widely used open-source HTTP server software.
J
jQuery
JavaScript libraries
Fast, small JavaScript library simplifying HTML manipulation, event handling, and Ajax.
Detected via Cloudflare Radar · Wappalyzer engine
이 도메인 신고하기
증거를 제출하고 다른 사람들을 보호하는 데 힘을 보태주세요
VirusTotal 분석
4 / 91 보안 공급업체가 이 도메인에 플래그를 지정했습니다.
View on VT
Last analyzed Previous stored snapshot: 5 detections
alphaMountain.ai
CRDF
Fortinet
Gridinsoft
보관된 증거
Wayback Machine Snapshot
증거 검토를 위해 과거 스냅샷을 사용할 수 있습니다.
사이트 성능 분석
Google PageSpeed Insights — mobile performance audit of investment-recovery-services.com · checked Jun 26, 2026
55
Needs Work
Performance
FCP
6.83s
First Contentful Paint
LCP
18.66s
Largest Contentful Paint
CLS
0
Cumulative Layout Shift
TBT
102ms
Total Blocking Time
SI
10.24s
Speed Index
Powered by Google PageSpeed Insights · Mobile strategy · Scores: 90-100 Good 50-89 Needs Work 0-49 Poor
증거 및 외부 보고서
증권 분석
Submitted Evidence Snapshot
Sent: Ledger records: 1
Case ID:
PD-20260216-D95F35 Recipient: abuse@s-host.com.ua Page title stored with report: Investment Recovery Service - Get your money back.
OSINT 및 정보
DNS 및 네트워크
SEO 및 도메인
이 사이트로 인해 영향을 받으셨나요?
If credentials were compromised, report immediately. Do not engage with recovery scammers.
계정 자격 증명, 개인 정보 또는 결제 정보를 입력했거나 이 도메인에서 파일을 다운로드한 경우 즉시 조치를 취하세요. 다음은 사건을 신고하고 자신을 보호하는 데 도움이 되는 리소스입니다.
PhishDestroy listing review 법 집행 보고서가 아님
도메인 이의신청
이 도메인을 소유하고 있고 목록이 잘못되었다고 생각되면 검토를 요청하세요.
회복 사기꾼들을 조심하세요! 범죄자는 수사관, 변호사, 회복요원인 척 하면서 피해자에게 다시 연락할 수도 있습니다. 선불 비용을 지불하거나 자격 증명을 공유하지 마십시오. 회복 관련 사기에 대해 자세히 알아보기 →
지역 당국에 신고하십시오
공식 사이버 범죄 연락처 또는 불만사항 초안 작성 →를 받으려면 국가를 선택하세요.
97개국 디렉토리
AI 지원 초안 - 사고 세부정보는 AI 제공업체에서 처리됩니다.
직접 검토하고 제출하세요.
관련 인프라 및 보고서
Content matches 1
동일 등록기관: NiceNIC 6
bullshit-proposal.xyz Across impersonation 8
These domains also target Across users. View all Across threats →
airdropcp.com 최근 위협 보고서 6
최근 PhishDestroy 데이터베이스에서 보고서가 추가되었습니다. 이러한 검색 링크는 공유 인프라나 소유권을 의미하지 않습니다.
finglobalheritage.online 
metamask-k.blogspot.com.ng 