recallnetwork[.]net

Analysis of recallnetwork.net shows a confirmed wallet/seed phishing operation that was taken offline prior to the report date of July 23, 2026. The domain was registered through Tucows Domains Inc. on September 01, 2025 and is hosted on the IPv4 address 178.16.54.253, which belongs to ASN202412 (Omegatech LTD) in the Netherlands. No TLS certificate is present, indicating that the site was served over plain HTTP. The page title returned by the server is "Recall Competitions," but no further content has been publicly disclosed.

Infrastructure details include the authoritative name servers ns1.virtualine.org and ns2.virtualine.org, both of which resolve to the same hosting provider. The site has been listed on two independent blocklists and is actively blocked by the PhishDestroy and ScamSniffer filtering services. VirusTotal scans recorded 12 detections out of 95 security vendors, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0 out of 100, the lowest possible rating.

The phishing kit identified for this operation is the "Airdrop Scam" kit, which is commonly used to solicit cryptocurrency wallet seeds under the pretense of a token airdrop. Defenders should immediately add recallnetwork.net and its associated IP address to network deny lists, monitor for any re‑registration attempts, and watch for similar kit signatures in other domains. Continuous observation of the AS202412 block and the virtualine.org name server pair is advised to detect potential repurposing for related campaigns.