crypto-refund[.]ca

Analysis as of July 24, 2026 indicates that crypto-refund.ca is an offline domain previously used for a crypto‑recovery scam. The site presented the page title “Canadian Crypto Recovery Service – No Fee Unless Successful | CryptoRefunds.ca”, which suggests it attempted to lure victims with a promise of fee‑free recovery. The domain was registered on March 06, 2026 through Open Provider Inc. and uses the parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. DNS resolution points to IP address 34.120.137.41, which belongs to Google LLC (AS396982) and is geolocated in the United States. No SSL certificate was observed for the host, indicating the site operated over plain HTTP.

Reputation data shows the domain is listed on three security blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded detections by 2 of 94 scanning engines, confirming malicious intent despite the limited coverage. The current HTTP status is offline, and the site is no longer reachable. Uncertainties remain regarding the full scope of the phishing infrastructure, such as any associated command‑and‑control servers or additional payloads, because no further forensic artefacts have been published.

The absence of a valid TLS certificate and the reliance on a generic parking nameserver configuration limit the ability to extract additional metadata from the host. Defenders should continue to enforce blocklist rules that include crypto-refund.ca, monitor outbound connections to the associated IP address, and ensure that any inbound traffic to the domain is denied at the firewall or DNS layer. Given the domain’s recent creation date and its appearance on multiple blocklists, it is advisable to treat any email or web references to crypto‑refund.ca as malicious. Continuous re‑evaluation is recommended in case the domain is re‑hosted or the infrastructure is resurrected.