tribu-tax[.]cl

This domain is flagged as a high-risk credential theft operation designed to harvest sensitive taxpayer information through deceptive tax-related services. Analysis indicates the site mimics legitimate tax platforms to trick users into submitting login credentials, financial details, or personal identification data, which are then exploited for identity theft or financial fraud. Infrastructure analysis reveals multiple indicators of compromise. The domain tribu-tax.cl resolves to IP address 149.56.250.52 and was registered on December 05, 2017, through NIC Chile. It is currently active and secured with a Let's Encrypt SSL certificate, which is commonly abused by threat actors to appear legitimate. Security vendors on VirusTotal flag the domain as malicious, with 6 out of 95 engines detecting fraudulent activity. Additionally, the domain appears in one threat intelligence pulse on AlienVault OTX, further corroborating its association with credential theft campaigns. To mitigate risks associated with this credential theft scam, users should avoid interacting with the domain or submitting any personal or financial information. Organizations should block access to 149.56.250.52 at the network level and monitor for any attempts to resolve or connect to tribu-tax.cl. Endpoint protection systems should be updated to include this domain and its associated IP in blocklists. Taxpayers should verify the authenticity of tax-related communications by cross-referencing with official government or service provider websites and report suspicious domains to relevant cybersecurity authorities for takedown.