contribuinte-fazenda[.]digital

Analysis conducted on July 25, 2026, confirms that the domain contribuinte-fazenda.digital is actively engaged in phishing operations targeting tax authority credentials. The domain was registered through Sav.com, LLC, a registrar frequently utilized by threat actors for rapid domain deployment. Infrastructure analysis reveals Cloudflare nameservers (zahir.ns.cloudflare.com and mina.ns.cloudflare.com), a common tactic to obscure hosting origins and evade IP-based blocking. At the time of assessment, the domain returns an HTTP 403 status, suggesting either a restricted access mechanism or a placeholder configuration pending malicious content deployment.

Detection metrics indicate limited but targeted awareness within the security community: the domain appears on a single blocklist and is flagged by 15 of 91 security vendors on VirusTotal. The absence of broader detection does not imply safety; rather, it reflects the domain's recent activation or evasion of automated crawlers. No associated IP address, autonomous system number, or hosting provider is currently documented, limiting attribution beyond registrar and DNS infrastructure. The domain name itself, translating to 'taxpayer-treasury' in Portuguese, aligns with known phishing campaigns impersonating government revenue agencies.

While the exact content of the site remains unanalyzed, the naming convention strongly suggests an intent to deceive users into submitting sensitive financial or identification data. Defenders are advised to treat this domain as high-risk and implement blocking at the DNS or network level. Organizations should monitor for credential submissions or redirects involving this domain, particularly within regions where Portuguese is the primary language. Further investigation into SSL certificates, historical DNS records, or passive DNS may yield additional infrastructure links to related campaigns.