chargezonerefill[.]media

chargezonerefill.media is an active generic phishing domain observed on 2026-07-12. The site was registered on 2025-11-09 through NiceNIC International Group Co., Limited and resolves to IP 64.29.17.65, which belongs to Amazon.com, Inc. (AS16509) in the United States. HTTP responses return a 307 redirect and the TLS certificate is issued by Let’s Encrypt (R13). The hosting infrastructure uses Vercel DNS (ns1.vercel-dns.com, ns2.vercel-dns.com) and the page reports a title of “Women Accessories Online | Fashion Jewelry, Bags”, indicating an attempt to lure victims interested in fashion accessories. The site implements HSTS and Google Analytics, suggesting a level of persistence. Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist (PhishDestroy). VirusTotal scans show 2 of 94 vendors flagging the domain, reinforcing suspicion. Current intelligence does not reveal the exact phishing payload or credential collection mechanism, so the full attack vector remains unknown. Defenders should immediately block traffic to chargezonerefill.media at network perimeters, add the domain to URL filtering and endpoint allow‑list exclusions, and monitor DNS queries for the associated IP and Vercel name servers. Ongoing observation of any new indicators, such as changes in HTTP status or additional vendor detections, is recommended.