mdfundsrecovery[.]com

This domain, mdfundsrecovery.com, is actively flagged as a high-risk brand impersonation targeting GoDaddy, with confirmed wallet and seed-phishing intent. Registered on July 23, 2025, through GoDaddy.com, LLC, the domain resolves to 13.248.243.5, hosted on Amazon.com, Inc. infrastructure (AS16509) in the US. Infrastructure analysis reveals the use of GoDaddy Website Builder, RequireJS, reCAPTCHA, Re:amaze, and HSTS, alongside GoDaddy-issued SSL certificates and nameservers (ns03.domaincontrol.com, ns04.domaincontrol.com). The page title, 'MD Funds Recovery,' aligns with the reported scam type of wallet or seed-phishing, though the exact content and mechanics remain unanalyzed. Evidence of malicious activity includes detection by 3 of 95 security vendors on VirusTotal and presence on one security blocklist. The domain remains operational with an HTTP 200 status, indicating active deployment. While the Gridinsoft trust score of 0/100 further supports its suspicious nature, defenders should note that the domain's hosting on legitimate infrastructure and use of standard security technologies (e.g., HSTS, reCAPTCHA) may complicate automated detection. Given the combination of brand impersonation, phishing classification, and active status, defenders are advised to block this domain at the DNS or proxy level, monitor for associated IP or certificate reuse, and alert users to the wallet-phishing risk. Further analysis of the site's content and backend behavior is recommended to confirm specific attack vectors.