maspriorityfunddeptgovsg[.]com

This domain is flagged as government impersonation phishing infrastructure with an elevated risk classification. Analysis indicates the domain was designed to mimic official financial or regulatory entities, likely targeting users seeking government-related financial services or emergency funds. The threat type aligns with credential harvesting and fraudulent transaction initiation patterns observed in similar campaigns. Infrastructure analysis reveals the domain was registered on March 22, 2026, through Ultahost, Inc., and resolved to IP address 159.100.6.19. Security vendor detections on VirusTotal reached 12 out of 95, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and was actively blocked by anti-phishing systems. A Let's Encrypt SSL certificate was present, providing a false sense of legitimacy. The page title displayed 'Account Suspended,' a common tactic to create urgency and prompt victims to enter credentials or personal information. Mitigation for this threat type involves immediate domain takedown coordination with registrars and hosting providers, particularly those facilitating rapid domain registration. Network defenders should update blocklists with the domain and associated IP address 159.100.6.19. Organizations should implement strict email filtering rules to quarantine messages containing government-related financial terms or urgent account notices. End users should be trained to verify domain authenticity by checking official government portals directly rather than following links, especially when prompted with account suspension warnings. Monitoring for similar domain registrations using permutations of 'priority fund' or government agency names is recommended.