declare-income[.]com

This domain is flagged as a generic phishing site specializing in fake income declaration scams, designed to deceive users into submitting personal or financial information under false pretenses. Analysis indicates an elevated risk level due to its association with fraudulent schemes targeting individuals seeking financial assistance or tax-related services. The domain is currently offline, but prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the following technical indicators: declared-income.com was created on October 20, 2025, and registered through HOSTINGER operations, UAB. It resolves to the IP address 217.60.252.86, which may be part of a broader malicious hosting infrastructure. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while independent trust scoring systems assign it a 0/100 trust score. The domain appears on two security blocklists and is actively blocked by at least two anti-phishing tools, further confirming its malicious classification. Mitigation steps for this threat type include immediate blocking of the domain and associated IP (217.60.252.86) at the network perimeter. Organizations should monitor for any attempts to access declare-income.com or related infrastructure, particularly in environments where financial or tax-related services are accessed. End-users should be educated on recognizing fake income declaration schemes, including verifying the legitimacy of any financial service provider through official channels before submitting sensitive information. If the domain resurfaces, security teams should treat it as high-risk and investigate any connections to it as potential indicators of compromise.