minnesota[.]revenueztu[.]cc

This domain, minnesota.revenueztu.cc, is identified as a credential theft phishing site designed to harvest user login credentials, financial details, or other sensitive information. The infrastructure mimics legitimate revenue or tax-related services, likely targeting individuals seeking state-specific financial assistance or tax filings. Analysis indicates the site employs deceptive forms and cloned interfaces to trick users into submitting personal data, which is then exfiltrated to attacker-controlled servers for fraudulent use or resale. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Dominet (HK) Limited, a registrar frequently associated with malicious domains. It resolves to the IP address 172.67.164.248 and is flagged by 7 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is currently offline, though this status may change. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to unsuspecting visitors. Users who visited minnesota.revenueztu.cc or entered credentials on the site should immediately reset passwords for any accounts accessed from the same device or network. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor financial statements and credit reports for suspicious activity, as stolen credentials may be used for identity theft or fraud. If personal or financial data was submitted, consider reporting the incident to relevant authorities or identity protection services. Avoid interacting with any communications or links associated with this domain, as attackers may attempt follow-up phishing attempts.