professionalcryptorecovery[.]com

Analysis of professionalcryptorecovery.com shows a high‑risk wallet/seed phishing operation targeting cryptocurrency users. The domain was registered on April 22, 2021 through NameCheap, Inc. and continues to resolve to the Amazon Web Services address 99.84.152.79, which is allocated to AS16509 in Germany. The site presents an SSL certificate issued by Amazon (Amazon RSA 2048 M04) and responds with an HTTP 301 status, indicating a permanent redirect. Technical profiling reveals a WordPress stack backed by MySQL and PHP, hosted on Amazon infrastructure and delivered via Amazon CloudFront, with Apache HTTP Server handling web traffic. The authoritative nameservers are ns-1193.awsdns-21.org, ns-2024.awsdns-61.co.uk, ns-444.awsdns-55.com, and ns-940.awsdns.

MX records point to Google’s mail infrastructure (aspmx.l.google.com and alt1.as...). The page title "Professional Crypto Wallet Recovery Service" aligns with the reported phishing kit labeled “Recovery Scam” and the scam type identified as Wallet/Seed Phishing. VirusTotal scans have flagged the domain in 4 of 95 security vendor checks, and the domain appears on a single public blocklist (PhishDestroy). Gridinsoft assigns a trust score of 39 out of 100, reflecting low confidence in the site’s legitimacy.

AlienVault OTX lists the domain in one threat‑intel pulse, providing additional corroboration of malicious intent. While the exact brand being impersonated is recorded as “across,” the available evidence does not disclose specific brand assets or victim interaction details beyond the page title. Defenders should block the domain and its resolving IP, enforce DNS sink‑holing, and monitor for related WordPress or AWS artifacts. Continuous reconnaissance of the associated AWS resources and periodic re‑scanning on VirusTotal and other sandbox services are recommended to capture any evolution of the phishing kit or payload delivery mechanisms.