verified-refunds[.]com

verified-refunds.com entered the PhishDestroy evidence set on Jun 14, 2026. The assembled evidence scores 83/100 (high).

Three independent sources are positive: VirusTotal, MetaMask, and SEAL. VirusTotal recorded 2 detections among 91 engines: Gridinsoft, Kaspersky on Jul 12, 2026 at 12:06 UTC. MetaMask and SEAL listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 18:20 UTC. The evidence is not unanimous. AlienVault OTX listed 1 community pulse reference (not vendor detections) on May 23, 2026 at 17:10 UTC. URLQuery recorded no positive detection. Google Safe Browsing returned no flag on May 24, 2026 at 05:00 UTC.

HTTP 200 was recorded on Aug 7, 2026 at 10:29 UTC. Registration records for the domain list GoDaddy.com, LLC as the registrar and May 23, 2026 as the creation date. Registration preceded first observation by 22 days. At collection time, the hostname resolved to 15.197.148.33 on AS16509 (Amazon.com, Inc.). The associated network metadata labels the endpoint as AWS Global Accelerator (GLOBAL) in Montreal, CA. The stored server header is cloudflare. Captured page title: “Verified Refunds – Helping reconnect you with money that is rightfully yours.”. TLS metadata lists GoDaddy.com / GoDaddy TLS Intermediate CA DV - R1v1 as the certificate issuer with validity through Dec 6, 2026; checked May 23, 2026 at 17:00 UTC.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. Taken together, the page content and independent findings support classifying this hostname as phishing. The stored record does not establish the post-click interaction, and it does not claim a confirmed wallet-draining transaction or credential submission.