irecovery[.]top

This domain, irecovery.top, was registered on February 21, 2026 through the registrar Spaceship, Inc. The authoritative name servers vda7900a.trouble‑free.net and vda7900b.trouble‑free.net resolve the domain to the IPv4 address 204.13.238.115, which belongs to AS19318 Interserver, Inc. located in the United States. No TLS certificate is present, indicating that the site does not offer encrypted connections. The page title returned by the live endpoint before takedown was “1 new message”, and the site was classified as a crypto‑scam targeting Binance users. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that it has been identified as malicious by multiple defensive platforms.

VirusTotal analysis shows that three out of ninety‑three scanning engines flagged the domain, providing additional corroboration of its malicious nature. The combination of brand impersonation, lack of HTTPS, and hosting on a shared provider aligns with typical infrastructure used for credential‑stealing or fund‑draining campaigns against cryptocurrency exchange customers. Because the domain is currently offline, detailed HTTP response codes and payloads could not be collected, leaving the exact phishing page structure unverified. However, the presence of a Binance impersonation tag and the “crypto scam” label strongly suggest that the site was intended to lure users into disclosing login credentials or sending crypto assets.

Defenders should add irecovery.top to internal block lists, monitor DNS queries for the associated IP range, and enforce outbound filtering that blocks connections to untrusted name servers such as trouble‑free.net. Email security gateways should be tuned to flag messages referencing “1 new message” or similar generic subject lines when paired with Binance branding. Incident response teams reviewing Binance‑related alerts should consider this domain as a false‑positive source of credential theft.