officialrecovery[.]com

This domain, officialrecovery.com, is flagged as an active phishing site targeting users under the guise of a Kazakhstan anti-fraud refund service. Registered on May 12, 2026, through NameCrane LLC, it resolves to IP 216.252.233.11, hosted in the Netherlands by THC Servers Global, LLC. The page title, rendered in Cyrillic, translates to 'Refund of funds — Anti-Fraud Kazakhstan,' indicating a localized phishing campaign. Infrastructure analysis reveals the use of Apache HTTP Server, jsDelivr for content delivery, and Facebook Pixel for tracking, suggesting an attempt to mimic legitimate service pages while monitoring victim interactions. The domain is currently active, returning an HTTP 200 status, and is blocked by at least one security vendor. It appears on one security blocklist, and five of 91 security vendors on VirusTotal flag it as malicious. Nameservers (ns1-ns4.thcservers.com) and a Let's Encrypt SSL certificate (R13) are consistent with low-cost hosting infrastructure often exploited for phishing. No specific phishing kit or targeted brand beyond the 'Anti-Fraud Kazakhstan' theme is confirmed in the available data. Defenders should treat this domain as high-risk. Immediate actions include blocking the domain and its resolving IP at perimeter security controls, monitoring for internal connections to 216.252.233.11, and alerting users to the phishing theme targeting Kazakhstan-based victims. Further analysis of the site's content and scripts may reveal additional indicators or victim data collection methods, but as of this report, no deeper technical breakdown is available.