quantumrecoveryservice[.]org

The domain www.quantumrecoveryservice.org was registered through Dynadot LLC on February 21, 2026 and is currently taken offline. Infrastructure analysis shows the domain resolves to IP 62.182.80.123, which belongs to AS30860 Virtual Systems LLC and is geolocated in Ukraine. The authoritative nameservers are dns1.geebytesdns.com and dns2.geebytesdns.com. No TLS certificate is presented, indicating the site was served over plain HTTP when active. The page title observed during the brief live period was "Quantum Recovery | Home," matching the listed page title in the intelligence feed.

The domain appears on a single security blocklist and is specifically blocked by PhishDestroy. VirusTotal scans recorded 11 detections out of 93 security vendors, reinforcing the malicious classification. The threat type is identified as wallet/seed phishing, suggesting attempts to harvest cryptocurrency wallet credentials or recovery seeds. Defenders should immediately block the domain and its resolving IP at perimeter firewalls and DNS filtering solutions.

Monitoring of the associated nameserver domains (geebytesdns.com) for new entries is advised, as they may be reused for related campaigns. Because the site is offline, active probing is limited, but the IP owner (Virtual Systems LLC) could be leveraged for sinkholing or abuse reporting. Email security gateways should be updated to flag any messages containing links to this domain or its sub‑resources. Continuous review of threat‑intel feeds for similar patterns and rapid inclusion of the domain in internal blocklists will help mitigate the elevated risk posed by this wallet/seed phishing operation.