legitcryptoscamrecovery[.]com

Analysis of the domain www.legitcryptoscamrecovery.com indicates a wallet and seed-phishing campaign impersonating the Across protocol, operational from February 21, 2026, until its takedown. The domain resolved to the IP address 212.1.212.97, hosted under AS47583 by Hostinger International Limited in the United States. A single security vendor on VirusTotal flagged the domain as malicious, while one security blocklist included it, and PhishDestroy confirmed its blocking.

The SSL certificate was issued by R12, a provider commonly observed in phishing infrastructure but not inherently malicious on its own. Infrastructure review reveals the domain was registered through an undisclosed registrar, with no additional historical DNS or subdomain data available at the time of analysis. The scam type, explicitly categorized as wallet and seed phishing, aligns with the observed brand impersonation of Across, though no page content or phishing kit details were provided for verification.

The domain's current offline status suggests mitigation, though defenders should remain vigilant for re-registration or migration to new infrastructure. Network defenders are advised to monitor for connections to 212.1.212.97 and related Hostinger IP ranges, as well as domains sharing the same SSL issuer or registration patterns. Given the limited detection coverage, additional scans using updated threat intelligence feeds are recommended to assess residual risk.