While reviewing what people search for right before landing on ComplaintCA, one pattern stood out: a cluster of searches trying to verify a single domain — "gov-refund.com" — using forensic tools like urlscan.io, VirusTotal, and WHOIS lookups. We checked it ourselves.
What We Found
A domain reputation check on gov-refund.com returned a suspicious verdict. The single biggest red flag: the domain was registered only one day before we checked it. A "government refund" site that's brand new is a textbook pattern — a real government agency's domain has existed for years; a scam site built to catch one news cycle or one wave of texts often goes live the same day the campaign starts.
How to Check Any Domain Like This Yourself
- Domain age — a WHOIS lookup (whois.com) shows the registration date. New registration, especially under 30 days, is the single strongest signal for this kind of scam.
- urlscan.io — shows you a live screenshot and the actual page structure without visiting it yourself.
- VirusTotal — checks the domain against dozens of security vendors' blocklists at once.
None of these require an account, and none of them are the government agency the site is impersonating — that's the point. Never use a link or number the suspicious message gives you to "verify" itself.
If You've Already Interacted With It
If you entered any personal or banking information, contact your bank immediately, then report it to the Canadian Anti-Fraud Centre at 1-888-495-8501. Don't wait to see if anything happens first.
Searching From the UK? Many People Were
Many of the searches for this domain also mentioned HMRC, gov.uk, or the subdomain "tax-rebate2024.gov-refund.com" — so the same "tax rebate" lure may be reaching people in the UK as well. If you received it there, forward suspicious emails to report@phishing.gov.uk and suspicious texts to 7726. HMRC also takes reports of messages pretending to be from it at phishing@hmrc.gov.uk (texts: 60599).
Got a link, email, or text that looks like this? Upload it for a free AI-assisted check before you click anything.
Verify a Document Now →Sources & Verification
The domain-age finding in this article comes from a direct threat-intelligence and public WHOIS registration check performed on gov-refund.com. General guidance on refund and government-impersonation scams is consistent with official guidance from:
- Canadian Anti-Fraud Centre
- GOV.UK — Report suspicious emails, websites and texts
- HMRC — Report phishing emails and texts
Learn more about how ComplaintCA verifies information on our About page.