refundxtoken[.]live

The domain refundxtoken.live was registered on June 22, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently listed as offline with an HTTP 451 response code. Infrastructure analysis shows the domain resolves to the IP address 64.29.17.1, which belongs to the Amazon.com, Inc. network (AS16509) located in the United States. The authoritative nameservers are mckenzie.ns.cloudflare.com and seth.ns.cloudflare.com, indicating the use of Cloudflare’s DNS services. TLS termination is provided by a Let’s Encrypt certificate issued for the second year of its validity, confirming the presence of HTTPS but offering no additional trust beyond standard certificate issuance.

Threat intelligence flags the site as a brand impersonation phishing operation. The page title "RefundX — Reclaim What's Yours" aligns with the advertised scam type of brand impersonation, though the specific brand being spoofed is not disclosed in the available data. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, suggesting that at least one anti‑phishing consortium has identified it as malicious. VirusTotal analysis reports a single positive detection out of 91 scanning engines, providing further corroboration of suspicious activity.

Given the limited publicly observable artifacts, the primary evidence consists of the domain’s recent creation date, its association with a reputable cloud provider, the presence of a valid TLS certificate, and the detection signals from blocklists and a solitary VirusTotal flag. The offline status and HTTP 451 response prevent direct content inspection, leaving the exact phishing payload and user‑facing elements unverified. Defenders should continue to monitor the IP address 64.29.17.1 for any future re‑hosting of malicious content, enforce DNS‑level blocking of refundxtoken.live, and update web‑gateway and endpoint protection rules to reflect the observed detection signatures.