contribuinte-fazendapr2026[.]com

This domain is flagged as an elevated-risk phishing site specifically targeting Brazilian taxpayers under the guise of an IPVA (Imposto sobre a Propriedade de Veículos Automotores) payment portal. Analysis indicates the site is designed to harvest sensitive financial credentials, including payment card details and personal identification numbers, by mimicking legitimate government tax collection interfaces. The fraudulent nature is reinforced by the use of deceptive branding and urgent payment prompts, common tactics in financial phishing campaigns. Infrastructure analysis reveals the domain was registered on January 20, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, which has been linked to other malicious activities. Detection metrics show the domain is flagged by 4 out of 95 security vendors on VirusTotal, appears on one security blocklist, and is referenced in a single AlienVault OTX threat intelligence pulse. The Gridinsoft trust score for this domain is 0/100, further confirming its malicious classification. Technologies detected include Java, Oracle WebLogic Server, Oracle HTTP Server, reCAPTCHA, jQuery, Google Hosted Libraries, Cloudflare Browser Insights, and Oracle Dynamic Monitoring Service, suggesting a sophisticated infrastructure designed to evade detection and appear legitimate. Mitigation steps for organizations and end-users include immediate blocking of the domain and its associated IP address (188.114.97.3) at the network perimeter. Financial institutions and government agencies should issue alerts to users about this specific phishing campaign, emphasizing the fraudulent IPVA portal. End-users are advised to verify the authenticity of tax-related communications by accessing official government websites directly via bookmarked URLs or trusted search results, rather than following links in unsolicited messages. Monitoring for unauthorized transactions and enabling multi-factor authentication on financial accounts can further reduce the risk of credential compromise. Security teams should correlate this domain with other indicators of compromise, such as the registrar PDR Ltd. and the creation date, to identify related threats in their environments.