recoverysupport[.]top
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of recoverysupport[.]top
The website appears to present itself as a cryptocurrency asset-recovery or escrow-withdrawal service under the title "Secure Asset Recovery." Based on the page content, it asks visitors to connect a crypto wallet in order to request a withdrawal, and it references Ethereum Mainnet, gas fees, and wallet pop-ups. The domain name and on-page wording suggest a service aimed at users who believe they have funds available for recovery or release from an escrow-like account.
The site does not appear to represent a well-known financial institution or established recovery provider based on the available scan data. Its structure looks like a single-purpose landing page rather than a full corporate website, and the use of wallet-connection libraries indicates that its main function may be to prompt direct blockchain wallet interaction. Multiple web-classification sources categorize the domain as phishing or fraud-related at the time of this scan, which is notable given the financial theme of the page.
Safety Assessment for recoverysupport[.]top
This domain shows mixed signals, but the overall risk profile appears elevated. Although only 1 out of 91 security engines flagged it directly, multiple web-classification providers categorized it as phishing or fraud-related at the time of this scan. In addition, the page design centers on persuading users to connect a cryptocurrency wallet to "recover" or withdraw assets, which is a pattern commonly associated with wallet-draining or social-engineering schemes.
Other scan elements were cleaner: the malware scan did not detect malicious files, external links were limited to common content-delivery and crypto-related libraries, and blacklist checks did not show listings at the time of review. However, a clean file scan does not rule out credential theft, deceptive wallet prompts, or malicious transaction requests delivered through client-side scripts.
Given the site’s young age, lack of broad reputation signals, phishing-related categorization by multiple sources, and the sensitive nature of wallet-connection requests, visitors should treat it with caution. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The domain uses a valid Let's Encrypt TLS certificate and is hosted on Netlify infrastructure backed by AWS EC2 in Frankfurt, Germany. It resolves through NS1 nameservers, and the site loads common third-party JavaScript and CSS resources including Bootstrap, Font Awesome, WalletConnect, ethers.js, and a blockchain explorer link template. DNSSEC appears to be unsigned.
From a technical standpoint, the hosting and certificate setup are fairly standard and do not by themselves indicate legitimacy or abuse. No malicious files or flagged outbound links were identified in the provided scan results, but the inclusion of wallet-connection tooling is significant because it enables direct interaction with users' crypto wallets. In this context, the primary concern appears to be potential phishing or deceptive transaction approval rather than conventional malware delivery.
Share your experience with this website. Was it safe? Did you encounter any issues?