retrievalxpert[.]com

On 25 July 2026 the domain retrievalxpert.com was observed actively serving content. The site was registered on 21 November 2024 through Web Commerce Communications Limited and resolves to the IPv4 address 91.222.173.19, which belongs to AS43641 SOLLUTIUM EU Sp z.o.o. located in the Netherlands. Authoritative name servers ns1-us.v-sys.org and ns2-us.v-sys.org are configured for the domain, and the TLS certificate is issued by Let’s Encrypt (R13). HTTP requests return status code 200, indicating a live web service.

The underlying stack consists of WordPress, MySQL, PHP, and Nginx, as identified by technology fingerprinting. Reputation metrics are adverse: Gridinsoft assigns a trust score of 1 / 100, and the domain appears on a single security blocklist. It has been flagged by one of ninety‑five VirusTotal scanners, and PhishDestroy lists the domain as blocked. The page title returned by the server is “Retrieval Xpert – Best Crypto Recovery”, suggesting a claim of cryptocurrency recovery services. No additional intelligence such as safe‑browsing verdicts, OTX identifiers, or sample hashes is available in the current feed.

The observable indicators confirm that retrievalxpert.com is being used in a high‑risk generic phishing campaign targeting users interested in cryptocurrency recovery. Defenders should add the IP address 91.222.173.19, the domain name, and its associated name servers to blocklists, enforce TLS inspection to detect the Let’s Encrypt certificate, and monitor for WordPress‑related exploitation patterns. Continuous re‑scanning with multi‑vendor platforms is advised to capture any new malicious payloads. At present, the primary uncertainty lies in the specific payload or credential‑harvesting mechanism employed; network traffic analysis of interactions with the site would be required to clarify the exact attack vector.