# PhishDestroy threat dossier — refundtransfer.team ================================================================ Fetched: 2026-04-27 16:59:33 UTC Canonical: https://phishdestroy.io/domain/refundtransfer.team/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 69/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/95 security vendors flagged this domain Flagging vendors: Webroot URLQuery: 2 detections ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 104.21.28.49 Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: jim.ns.cloudflare.com, tori.ns.cloudflare.com Registered: 2026-04-06 Expires: 2027-04-06 Page title: Refund Transfer Office | Fund Recovery Experts HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E7 Expires: 2026-07-23 Status: INVALID chain Fingerprint: 20b7f1139eeb733d851be727be7c0be6c9072aa6f59aa510646cff24e8e93cd6 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-06 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-27 05:58:08 UTC (by PhishDestroy tracker) First reported: 2026-04-27 02:58:55 UTC (abuse notice filed) Last verified: 2026-04-27 13:00:20 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dccde-9dff-751a-b302-8a9cab766353/ URLQuery: https://urlquery.net/report/cbabd0f8-56a5-4488-8d5d-08bddee3a351 Wayback Machine: https://web.archive.org/web/*/refundtransfer.team crt.sh CT logs: https://crt.sh/?q=%25.refundtransfer.team Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=refundtransfer.team AlienVault OTX: https://otx.alienvault.com/indicator/domain/refundtransfer.team URLhaus: https://urlhaus.abuse.ch/host/refundtransfer.team/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-27 05:58:50 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies refundtransfer.team as an active tax refund phishing domain targeting unsuspecting users with fraudulent refund claims. This domain is currently under investigation as part of an ongoing campaign designed to deceive victims into disclosing sensitive financial or personal information under the guise of processing legitimate tax refunds. The domain refundtransfer.team was flagged by 0 of 95 VirusTotal vendors at the time of analysis, indicating that it has not yet been widely recognized as malicious by security vendors. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 06, 2026, and is associated with the IP address 104.21.28.49. The domain utilizes a Let's Encrypt SSL certificate, which may be leveraged to enhance its perceived legitimacy. Notably, the domain has not been observed on any known blocklists, and its trust scores remain unverified at this stage. Despite the absence of detections, the recent creation date and active resolution to a high-reputation IP address warrant heightened scrutiny. Given the active status of this domain and the specific threat posed—tax refund phishing—users and organizations are advised to exercise extreme caution when encountering any communications referencing refundtransfer.team or similar domains. Immediate actions include blocking the domain at the network perimeter and updating DNS filtering rules to prevent access. Additionally, security teams should monitor for any associated indicators of compromise (IOCs) and conduct user awareness training to mitigate the risk of falling victim to this scam. As this domain is still under investigation, continuous monitoring and updates from threat intelligence platforms are strongly recommended to stay ahead of potential escalations in malicious activity. [Updates since narrative was generated:] - VirusTotal detections: now 1/95 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260427-4E2A7D TLS cert SHA-256: 20b7f1139eeb733d851be727be7c0be6c9072aa6f59aa510646cff24e8e93cd6 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/refundtransfer.team/ JSON API: https://api.destroy.tools/v1/check?domain=refundtransfer.team Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io