recoverscammedcrypto[.]com

Analysis of recoverscammedcrypto.com shows a short‑lived infrastructure built to impersonate crypto.com. The domain was registered on October 16, 2025 through SOLLUTIUM LLC and is currently offline, returning HTTP 500 responses. DNS resolution points to IP 91.222.173.19, which is hosted in the Netherlands under ASN 43641 (SOLLUTIUM EU Sp z.o.o.). The authoritative nameservers are ns1-us.v-sys.org and ns2-us.v-sys.org, and the domain publishes an MX record that loops back to itself (priority 0, host recoverscammedcrypto.com).

A Let’s Encrypt R12 certificate secures the site, but the server stack consists of WordPress, MySQL, PHP, and Nginx, typical of generic web‑hosting kits. Threat intelligence flags the domain as a crypto scam: it is listed on one public blocklist, is blocked by PhishDestroy, and has a Gridinsoft trust score of 1 out of 100. VirusTotal reports three detections out of ninety‑five scanners, indicating partial malicious classification.

The page title mirrors the domain name, and no additional content details are available. Defenders should add the domain and its resolving IP to deny‑list rules, monitor for any resurgence of the same hostnames or certificate patterns, and treat any email traffic referencing the MX record as suspicious. Continuous surveillance of the SOLLUTIUM‑associated name servers is advisable, as they may be reused for future impersonation campaigns targeting crypto‑related brands.