gov-ambiente[.]net

This domain is flagged under active investigation for hosting a targeted government-themed phishing campaign, specifically impersonating Portuguese tax authority (gov.pt) infrastructure. Analysis indicates the threat type is credential harvesting, designed to deceive users into submitting sensitive fiscal data under the guise of a mandatory update. Infrastructure analysis reveals the domain gov-ambiente.net was registered on June 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with low-reputation registrations. The domain resolves to IP address 178.16.54.253, currently not listed on major blocklists. VirusTotal detection metrics show 0/95 engines flagging the domain as malicious, suggesting either recent deployment or evasion techniques. The page title, "Atualização de Dados Fiscais - gov.pt," directly mimics legitimate Portuguese government tax update portals, increasing the likelihood of successful social engineering. Mitigation requires immediate action from network defenders and end users. Organizations should block the domain and IP at perimeter defenses, including firewalls and DNS filters. Security teams are advised to monitor for connections to 178.16.54.253 and review logs for interactions with gov-ambiente.net. End users should be alerted to verify the authenticity of any gov.pt tax update requests by accessing official portals directly via bookmarked URLs or government-issued communications. Multi-factor authentication should be enforced for all tax-related accounts to reduce the impact of potential credential compromise.