safecoinrefunds[.]com

Analysis of the domain safecoinrefunds.com confirms its classification as a cryptocurrency refund scam site, based on observable infrastructure and detection evidence. The domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to the IP address 185.151.30.168, hosted by 20i Limited (AS48254) in the United Kingdom. The site's page title, 'Safe Coin Refunds | Fast,' directly references cryptocurrency refund services, a common lure in phishing campaigns targeting digital asset holders. Infrastructure analysis reveals the use of StackPath nameservers (ns1.stackdns.com through ns4.stackdns.com) and an MX record pointing to mx.stackmail.com, indicating reliance on third-party hosting and email services. The site employs a Let's Encrypt SSL certificate (R12), providing HTTPS encryption, which is frequently exploited by threat actors to lend false legitimacy to fraudulent domains. Technologies detected include WordPress, MySQL, PHP, Apache HTTP Server, Swiper, jQuery Migrate, and jQuery, suggesting a templated or kit-based deployment rather than a custom-built phishing page.

Detection data further supports the malicious classification. The domain appears on one security blocklist and is flagged by three of 93 security vendors on VirusTotal, including PhishDestroy. AlienVault OTX lists the domain in one threat intelligence pulse, indicating prior identification in active phishing campaigns. Gridinsoft assigns a trust score of 0/100, reflecting high confidence in its malicious nature. At the time of this report, the domain has been taken offline, though its prior HTTP status of 200 confirms it was operational and accessible to victims.

Defenders should treat this domain as confirmed malicious infrastructure. The combination of cryptocurrency-themed branding, low trust scores, and detection by multiple security vendors warrants immediate blocking at the DNS and network levels.