refundtransfer[.]team

PhishDestroy identifies refundtransfer.team as an active tax refund phishing domain targeting unsuspecting users with fraudulent refund claims. This domain is currently under investigation as part of an ongoing campaign designed to deceive victims into disclosing sensitive financial or personal information under the guise of processing legitimate tax refunds. The domain refundtransfer.team was flagged by 7 of 95 VirusTotal vendors at the time of analysis, indicating that it has not yet been widely recognized as malicious by security vendors. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 06, 2026, and is associated with the IP address 104.21.28.49. The domain utilizes a Let's Encrypt SSL certificate, which may be leveraged to enhance its perceived legitimacy. Notably, the domain has not been observed on any known blocklists, and its trust scores remain unverified at this stage. Despite the absence of detections, the recent creation date and active resolution to a high-reputation IP address warrant heightened scrutiny. Given the active status of this domain and the specific threat posed—tax refund phishing—users and organizations are advised to exercise extreme caution when encountering any communications referencing refundtransfer.team or similar domains. Immediate actions include blocking the domain at the network perimeter and updating DNS filtering rules to prevent access. Additionally, security teams should monitor for any associated indicators of compromise (IOCs) and conduct user awareness training to mitigate the risk of falling victim to this scam. As this domain is still under investigation, continuous monitoring and updates from threat intelligence platforms are strongly recommended to stay ahead of potential escalations in malicious activity.