receita[.]govpagamentos[.]com

Analysis of receita.govpagamentos.com as of July 29, 2026 indicates this domain is an active phishing site targeting users with a fraudulent tax payment interface. The domain is registered through GoDaddy.com, LLC and uses Cloudflare nameservers (odin.ns.cloudflare.com, wally.ns.cloudflare.com), a common pattern observed in phishing infrastructure to obscure hosting origins. It resolves to IP address 172.67.153.113, which is part of Cloudflare's network, further complicating direct attribution.

Fourteen out of ninety-one security vendors on VirusTotal have flagged this domain, and it appears on at least one security blocklist, including PhishDestroy. No additional context is available regarding the specific brand impersonation or phishing kit in use, as the exact page content has not been analyzed. Defenders should treat this domain as high-risk for financial fraud or credential theft, particularly given the inclusion of 'receita' (Portuguese for 'revenue'), which suggests targeting of Brazilian tax authority users or similar government payment systems.

Immediate blocking at the DNS or proxy level is recommended, and organizations should monitor for any internal traffic to this domain. Further investigation into associated IP ranges and registration details may reveal linked phishing campaigns. No Safe Browsing or Open Threat Exchange data is currently available to confirm additional detection status.