receitaservice[.]com

This domain is flagged as an active high-risk phishing site specifically targeting individuals seeking fiscal status verification. Analysis indicates the infrastructure is designed to impersonate legitimate Brazilian tax authority services, as evidenced by the page title 'Consulta - Situação Fiscal' and the domain's thematic construction. The threat type involves credential harvesting through fake government portals, a common tactic in financial fraud campaigns targeting taxpayers. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain receitaservice.com resolves to IP address 108.181.162.49 hosted on AS40676 (Psychz Networks) in the United States, despite its Brazilian-themed content. It uses a Let's Encrypt SSL certificate (YR1) to create a false sense of legitimacy. VirusTotal detection shows 1/95 security vendors currently flagging this domain, while it appears on one security blocklist and is specifically blocked by PhishDestroy. The domain was registered through Spaceship, Inc. on June 13, 2026, with this future registration date suggesting potential domain squatting or registry manipulation. Mitigation steps should focus on immediate containment and user protection. Network administrators should implement DNS blocking for 108.181.162.49 and the domain across all organizational systems. End users should be educated to verify government portals through official .gov.br domains and never enter credentials on sites lacking proper government authentication markers. Financial institutions should monitor for compromised credentials from this campaign, particularly those used for tax-related services. The future-dated registration warrants additional scrutiny, as this may indicate attempts to bypass domain age-based security filters.