crypto-recovery[.]ch

crypto-recovery.ch was registered on 21 February 2026 and is presently hosted on IP 15.235.54.156, an OVH SAS address in Canada (AS16276). The domain resolves through Cloudflare nameservers roan.ns.cloudflare.com and treasure.ns.cloudflare.com and serves a WordPress site backed by MySQL, PHP, Redis with object caching, and enforces HSTS over HTTP/3. The visible page title reads “Payback Capitals – Experts in reclaiming lost funds,” indicating a claim to recover compromised cryptocurrency assets. The site is classified as a wallet/seed phishing operation, targeting private keys or seed phrases. Security scanning on VirusTotal recorded detections from 2 of 93 vendors, and Gridinsoft assigned a trust score of 0/100. The domain appears on a single blocklist and is already blocked by PhishDestroy. An MX record with priority 10 points to mail.crypto-recovery.ch, suggesting potential use for phishing email delivery. The HTTP response currently returns 403, which may indicate access restrictions or active takedown attempts. No public evidence of the site hosting malicious binaries or redirecting to external cryptocurrency drainers has been observed. Defenders should block the domain and associated IP at perimeter defenses, monitor for outbound connections to the IP and its Cloudflare edge nodes, and enforce email filtering for the mail sub‑domain. Incident response teams should treat any credentials or seed phrases reported by users as compromised and advise immediate wallet re‑creation. Ongoing intelligence collection should focus on capturing the site’s payload, observing any changes in infrastructure, and correlating phishing emails that reference the “Payback Capitals” branding.