recovery[.]sequence[.]app

This domain, recovery.sequence.app, is under investigation for cryptocurrency-related phishing activity following its detection on a security blocklist and confirmation of active hosting. Registered on February 21, 2026, through a corporate registrar, the domain resolves to 185.199.108.153, an IP address assigned to a content delivery network provider in the United States. The page title, 'Sequence Recovery Wallet,' suggests an attempt to impersonate a cryptocurrency wallet recovery service, though the exact content and functionality of the site remain unconfirmed due to limited analysis. Infrastructure analysis reveals the use of Cloudflare nameservers and a Let's Encrypt SSL certificate, which are common among both legitimate and malicious sites. The domain is hosted on a platform associated with static site deployment, as indicated by detected technologies including GitHub Pages and Fastly. While no detections were recorded on a major malware scanning service as of the latest check, this does not preclude the possibility of malicious intent, particularly given the domain's presence on a security blocklist and its targeting of cryptocurrency users. The risk level remains under investigation due to insufficient technical indicators to confirm or dismiss malicious activity definitively. Defenders are advised to monitor network traffic for connections to this domain, particularly in environments where cryptocurrency transactions or wallet recovery processes occur. Blocking the domain at the DNS or firewall level is recommended as a precautionary measure until further analysis confirms its legitimacy or malicious nature. Additional scrutiny of related infrastructure, such as the hosting IP and associated domains, may provide further context for this investigation.