dnsrecursive[.]eu

This investigation documents dnsrecursive.eu, observed as an active generic phishing infrastructure as of 2026-08-02. The domain is listed on one public security blocklist and has been actively blocked by the PhishDestroy mitigation service. VirusTotal analysis shows that 11 of 91 scanned security vendors flagged the domain, indicating a moderate level of detection consensus.

The risk rating assigned by the reporting source is elevated, and the operational status is marked active, suggesting the site remains reachable. No public data on registrar, registration date, IP address, ASN, hosting provider, SSL certificate details, HTTP response codes, or Safe Browsing verdicts were supplied in the available intelligence. Consequently, the underlying hosting environment and potential geolocation remain unknown.

The limited evidence set restricts attribution; however, the presence on a blocklist and multiple vendor detections provide sufficient indication that dnsrecursive.eu is being used to host phishing content. Defenders should continue to block the domain at network perimeter filters, update DNS blacklists, and monitor for any new indicators such as IP resolution changes or additional vendor detections. Ongoing collection of passive DNS, WHOIS, and TLS fingerprint data is recommended to refine the threat profile and support mitigation efforts.