refundxtoken[.]live

refundxtoken.live entered the PhishDestroy evidence set on Jun 24, 2026. The stored content classification is brand impersonation. The assembled evidence scores 58/100 (elevated).

One independent source is positive: VirusTotal. VirusTotal recorded 1 detections among 91 engines: Gridinsoft on Jul 18, 2026 at 18:45 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 14:20 UTC. Google Safe Browsing returned no flag on Jun 24, 2026 at 15:30 UTC. URLScan completed without a malicious verdict (score 0) on Jun 25, 2026 at 08:13 UTC.

HTTP 451 (Unavailable for Legal Reasons) was recorded on Aug 7, 2026 at 02:09 UTC. Latest classified outcome: provider block observed; cause vercel deployment disabled; mechanism deployment disabled; observed actor Vercel on Aug 7, 2026 at 00:09 UTC. Registration records for the domain list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar and Jun 22, 2026 as the creation date. Registration preceded first observation by 1 day. At collection time, the hostname resolved to 64.29.17.1 on AS16509 (AMAZON-02 - Amazon.com, Inc., US). The associated network metadata labels the endpoint as AS16509 Amazon.com, Inc. in Walnut, US. The stored server header is Vercel. Captured page title: “RefundX — Reclaim What's Yours”. DOM analysis completed on Jun 24, 2026 at 18:20 UTC; stored DOM score 0/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Jul 29, 2026 at 02:51 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists Let's Encrypt / YR2 as the certificate issuer with validity through Sep 20, 2026; checked Jun 24, 2026 at 16:00 UTC.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings.