fastrecovery[.]icu[.]index-trading[.]ltd

The domain fastrecovery.icu.index-trading.ltd was registered on February 21, 2026 through Global Domain Group LLC and resolves to the IPv4 address 198.12.66.123, which is announced by AS36352 (HostPapa) and geolocated to the United States. The authoritative nameservers are 5772.ns1.abovedomains.com and 5772.ns2.abovedomains.com. An HTTP request to the site returns a 200 status code and the page title "Fast Recovery - Home". The site presents itself as an ecommerce‑type offering, and the brand target is explicitly listed as Amazon, indicating a brand‑impersonation campaign.

Reputation signals are strongly negative. The Gridinsoft trust score is 0 out of 100, the SSL certificate rating is R10, and the domain appears on one security blocklist. VirusTotal analysis shows that 3 of 95 scanned security vendors flag the domain as malicious. The site is already blocked by the PhishDestroy mitigation system. These indicators collectively confirm that the infrastructure is being used for a high‑risk brand‑impersonation operation. The limited detection count on VirusTotal suggests that the payload or hosting may be newly deployed, but the presence of multiple independent detections confirms malicious intent.

Defenders should prioritize immediate containment. Network perimeter controls ought to block both the domain fastrecovery.icu.index-trading.ltd and its resolving IP 198.12.66.123. Email and web gateway filters should be updated to flag any communications referencing the domain or the associated Amazon impersonation indicators. Continuous monitoring of the AS36352 prefix for additional suspicious hosts is recommended, as the same hosting provider may be leveraged for related campaigns. Because visual or content analysis of the landing page is not available, threat‑intel teams should treat any observed traffic to this domain as hostile until a deeper forensic examination can be performed.