comptroller[.]payfghj[.]cc

comptroller.payfghj.cc is a subdomain of payfghj.cc. PhishDestroy first observed the hostname on Jun 12, 2026. Stored content metadata identifies Govtexas as the apparent target. The captured page title is “Texas Taxes”. Current evidence score: 95/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and URLScan. VirusTotal recorded 15 detections among 91 engines: ADMINUSLabs, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Lionic, SOCRadar, Sophos, VIPRE, Webroot on Jul 29, 2026 at 04:30 UTC. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Govtexas and assigned phishing as its category on Aug 1, 2026 at 03:31 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 22:20 UTC. Google Safe Browsing returned no flag on Jul 29, 2026 at 04:30 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:32 UTC; content was unavailable. Registration records for the registrable domain payfghj.cc list Dominet (HK) Limited as the registrar and Jun 12, 2026 as the creation date. Registration and first observation occurred on the same UTC date. At collection time, the hostname resolved to 170.106.160.91 on AS132203 (Tencent Building, Kejizhongyi Avenue). The recorded endpoint location is Santa Clara, US. The stored server header is nginx. The evidence archive retains 1 visual capture from PhishDestroy. TLS metadata lists R12 as the certificate issuer.

The content indicators and 2 positive source findings support the current Govtexas impersonation and phishing classification. The target field identifies Govtexas, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.