# crypto-refund.ca — SUSPICIOUS

> crypto-refund.ca is an active phishing threat under investigation. Stay vigilant and avoid interactions. Learn more to protect yourself now.

## Summary
PhishDestroy identifies crypto-refund.ca as a generic phishing domain registered recently on March 03, 2026. The site is currently classified as under investigation due to suspicious activity patterns linked to crypto-related scams.

The domain resolves to IP 34.120.137.41 and was registered via Open Provider Inc., a common registrar for short-lived fraudulent domains. Notably, the domain has zero detections on VirusTotal, emphasizing reliance on behavioral and infrastructural indicators for analysis.

Status remains active with ongoing monitoring. Users are advised to exercise caution and report any suspicious encounters. PhishDestroy will update its findings as more intelligence emerges on this evolving threat.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 0)
- Page title: Canadian Crypto Recovery Service – No Fee Unless Successful | CryptoRefunds.ca

## Domain Intelligence
- Registered: 2026-03-06 11:07:01
- Registrar: Open Provider Inc.
- Country: US
- IP: 34.120.137.41
- IP Country: US
- IP City: Kansas City
- IP Org: AS396982 Google LLC
- Nameservers: ["ns1.dns-parking.com", "ns2.dns-parking.com"]
- SSL Issuer: none

## Detection Status
- VirusTotal: 2 vendors flagged
  Vendors: ["Gridinsoft", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 3 hits
  Lists: ["PhishDestroy", "MetaMask", "SEAL"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019cc297-34c8-7716-b098-c38698796edf.png
- Cloudflare Radar: https://radar.cloudflare.com/domains/crypto-refund.ca
- Wayback Machine: https://web.archive.org/web/https://crypto-refund.ca
- PhishDestroy: https://phishdestroy.io/domain/crypto-refund.ca/
- LLM endpoint: https://phishdestroy.io/domain/crypto-refund.ca/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/crypto-refund.ca/
Last updated: 2026-03-19