taxprocessinfo[.]live

PhishDestroy has identified taxprocessinfo.live as a dangerous phishing domain that impersonates the Internal Revenue Service (IRS) login page to steal taxpayers' credentials. The site's title, "Filing | Internal Revenue Service," is a direct copy designed to trick users into entering sensitive information such as Social Security numbers and tax details. This generic phishing threat targets individuals expecting to file taxes, potentially leading to identity theft and financial fraud.

Technical analysis reveals that the domain was created on February 21, 2026, and registered through NiceNIC International Group Co., Limited, a registrar often associated with malicious domains. The SSL certificate is issued by Let's Encrypt (R12), which provides an illusion of security but does not validate the site's legitimacy. The domain resolves to IP address 152.232.9.171 and is currently offline, though it may reappear. On VirusTotal, 3 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. The low detection rate suggests the domain is relatively new or uses evasion techniques.

If users have visited taxprocessinfo.live, they should immediately change any passwords used on that site, enable two-factor authentication on their accounts, and monitor financial accounts for suspicious activity. PhishDestroy recommends verifying all IRS-related communications through official channels, as the IRS never initiates contact via email or text links. Users should scan their devices for malware and consider placing a fraud alert on their credit reports to prevent identity theft.