microsoft-refund[.]com

PhishDestroy first observed microsoft-refund.com on Jun 13, 2026. The hostname explicitly references Microsoft; stored content metadata identifies the same apparent target. Stored page analysis classifies the content as brand impersonation. Current evidence score: 90/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, MetaMask, SEAL, and DNS security resolvers. VirusTotal recorded 6 detections among 91 engines: alphaMountain.ai, Gridinsoft, SOCRadar, Webroot on Jul 18, 2026 at 16:06 UTC. MetaMask and SEAL listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 22:20 UTC. DNS security checks returned 2 blocking results across 14 tested policies: Brand Microsoft, Quad9 Secure; no observation timestamp was retained. Non-positive and contextual checks: AlienVault OTX listed 2 community pulse references (not vendor detections) on Jun 13, 2026 at 10:10 UTC. Google Safe Browsing returned no flag on Jun 13, 2026 at 05:29 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:32 UTC; content was unavailable. Registration records for the domain list GoDaddy.com, LLC as the registrar and Jun 13, 2026 as the creation date. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 15.197.148.33 on AS16509 (Amazon.com, Inc.). The recorded endpoint location is Montreal, CA. The evidence archive retains 1 visual capture from PhishDestroy; no page title was retained, so the captures preserve the landing-page appearance.

The content indicators and 4 positive source findings support the current Microsoft-themed brand impersonation classification.