verified-refunds[.]com

This domain, verified-refunds.com, is actively flagged as a high-risk phishing resource targeting individuals through fraudulent refund schemes. Registered on May 23, 2026, via GoDaddy.com, LLC, the domain presents itself with the page title 'Verified Refunds – Helping reconnect you with money that is rightfully yours,' a narrative designed to exploit trust in financial recovery services. Analysis indicates the domain resolves to 15.197.148.33, an address associated with AWS Global Accelerator infrastructure located in Canada, a common hosting choice for phishing operations due to its scalability and geographic flexibility. Infrastructure analysis reveals the domain is configured with nameservers ns67.domaincontrol.com and ns68.domaincontrol.com, consistent with GoDaddy’s default DNS management. The SSL certificate, issued by GoDaddy’s intermediate CA, provides basic encryption but does not validate the legitimacy of the site’s content. Detection metrics show the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, while only two of ninety-five security vendors on VirusTotal currently flag it as malicious. This discrepancy suggests either early-stage detection or evasion tactics that have yet to trigger broader vendor responses. The domain’s registration and hosting patterns align with known phishing campaigns leveraging cloud-based infrastructure to avoid immediate takedowns. While the exact phishing kit or targeted brands remain unconfirmed, the domain’s active status and thematic focus on refunds indicate an intent to harvest personal and financial data under false pretenses. Defenders should prioritize blocking the domain at the DNS or network level, particularly in environments where financial transactions or user authentication occur. Monitoring for related domains registered through the same registrar or resolving to the same IP may uncover additional components of this campaign.