recov-authority[.]com

This domain, recov-authority.com, is identified as a credential theft phishing operation targeting users through fraudulent recovery service impersonation. Analysis indicates the site was designed to mimic legitimate account recovery portals, tricking victims into submitting sensitive login credentials, including usernames, passwords, and multi-factor authentication codes. No direct evidence of a crypto drainer kit or wallet-draining payload was observed, but the infrastructure aligns with credential harvesting campaigns commonly used to facilitate subsequent account takeovers or financial fraud. Infrastructure analysis reveals the domain was registered on April 02, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 188.114.97.3, which has been linked to other malicious activities in recent threat intelligence reports. At the time of assessment, the domain was flagged by 17 out of 95 security vendors on VirusTotal, indicating a moderate-to-high confidence in its malicious classification. It appears on one security blocklist, and while Google Safe Browsing (GSB) status is not explicitly provided, the domain's inclusion in PhishDestroy’s blocklist further corroborates its fraudulent nature. The creation date, combined with the rapid detection by security vendors, suggests a short-lived but aggressive campaign. The domain is currently offline, reducing immediate exposure risk to end users. However, the infrastructure remains a latent threat, as the registrar and hosting IP have not been fully remediated. Historical DNS records and cached content may still pose risks if accessed through archival services or local resolver caches. Organizations are advised to proactively block the domain and associated IP at the network perimeter, while end users should verify recovery requests through official channels only. Given the elevated risk level, continuous monitoring of related domains registered under the same registrar or resolving to the same IP is recommended to preempt potential follow-up campaigns.