partners-refunds[.]org

Analysis of partners-refunds.org shows a newly registered domain created on July 30 2026 through GoDaddy.com, LLC. The authoritative nameservers are ns59.domaincontrol.com and ns60.domaincontrol.com, both typical of GoDaddy’s default DNS service. DNS resolution points to the IPv4 address 76.223.105.230, which currently hosts the site. The HTTP response returns a page titled “Partners Refunds”. No SSL certificate details are provided in the available intelligence, and no HTTP status code is reported.

The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy feed, indicating that at least one downstream protection service has identified it as malicious. VirusTotal indicates the domain was scanned by 91 antivirus and URL‑reputation vendors, with none reporting a detection at the time of analysis; this lack of detections does not constitute a safety assurance. No additional intelligence such as OTX references, Safe Browsing verdicts, or public reputation scores is present. The limited data suggest the domain is being used for a generic phishing campaign, likely to lure victims into submitting refund‑related information, as implied by the page title.

However, the actual content of the site, the specific brand being spoofed, and any credential‑capture mechanisms have not been observed. Defenders should continue to block traffic to 76.223.105.230 and monitor DNS queries for partners-refunds.org. Adding the domain to local blocklists and ensuring web filtering solutions reference the PhishDestroy feed will reduce exposure. Continued observation is recommended to capture any changes in content, additional detections, or new blocklist listings.