servicos-br-sefaz[.]site

PhishDestroy identifies servicos-br-sefaz.site as an active crypto drainer impersonating Brazilian tax authority services (SEFAZ). This domain leverages a generic phishing vector to deceive users into connecting wallets under the guise of tax compliance, risking direct asset exfiltration. The threat level is currently under investigation but remains active due to observed infrastructure alignment with known drainer toolkits.

This domain exhibits several red flags across multiple threat intelligence dimensions. VirusTotal reports 0 out of 95 antivirus engines flagging the domain, indicating a low detection rate despite its malicious intent. Registered through HOSTINGER operations, UAB on April 29, 2026, it resolves to IP 172.67.218.90 and holds a valid Let's Encrypt SSL certificate, which may lend false legitimacy. The combination of recent registration, low detection coverage, and hosting provider reputation suggests opportunistic deployment rather than long-term infrastructure.

To mitigate exposure to this crypto drainer, users should avoid interacting with servicos-br-sefaz.site entirely. Verify any tax-related communications through official Brazilian government channels (e.g., sefaz.[state].gov.br) and never connect wallets to untrusted domains. Block the IP 172.67.218.90 at the firewall level and report the domain to PhishDestroy for community-wide protection. Monitor wallet transactions for unauthorized transfers post-interaction, as drainers often execute rapidly after wallet connection.