momentum-recovery[.]ca

Analysis of momentum-recovery.ca, created on 3 November 2025 and hosted on an Amazon‑owned IP (76.223.105.230, AS16509), shows a high‑risk brand‑impersonation campaign targeting Google users. The domain is registered through Go Daddy Domains Canada, Inc. and uses GoDaddy’s default nameservers (ns09.domaincontrol.com, ns10.domaincontrol.com). It resolves over HTTPS with a Go Daddy Secure Certificate (G2) and returns HTTP 200, indicating an active web service. The page title is the bare domain name, providing no further context. Technical fingerprints reveal the use of GoDaddy Website Builder, RequireJS, reCAPTCHA, Re:amaze live‑chat widget, and enforced HSTS, all typical of a quickly assembled phishing kit.

Infrastructure indicators include a single MX record pointing to momentumrecovery-ca02b.mail.protection.outlook.com, suggesting the operator has provisioned outbound mail capability, potentially to send lure messages. The domain appears on one public blocklist and is explicitly listed by PhishDestroy as malicious. VirusTotal scans have flagged the site by four of ninety‑five security vendors, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The campaign is classified as a tech‑support scam that masquerades as a Google support request, though the exact content of the landing page has not been captured. Defenders should immediately add momentum-recovery.ca to URL filtering and endpoint allow‑list block rules, monitor outbound connections to the associated MX host, and enforce user education on unsolicited Google support communications.

Given the recent creation date, the domain has not yet accumulated a large reputation history, which limits passive detection and makes proactive blocking essential. The presence of reCAPTCHA suggests an attempt to appear legitimate to browsers, while the Re:amaze widget may be used to collect victim responses in real time.