phila[.]revenue-kw[.]cc

The domain phila.revenue-kw.cc is currently active and has been identified as a credential harvesting platform. Registration data shows it was created on September 16, 2025 through Dominet (HK) Limited, a registrar based in Hong Kong. DNS resolution points to the IP address 43.130.77.166, which is the sole host associated with the domain in public records.

Threat intelligence indicates the domain appears on one external security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that defensive feeds consider it malicious. VirusTotal analysis reports that 14 of 91 scanning engines flag the domain as malicious, providing a modest but notable detection consensus. No additional public evidence such as SSL certificate details, HTTP response codes, Safe Browsing status, or page title information is presently available, leaving the exact content and lure mechanisms unverified.

Defenders should treat the domain as high‑risk: network firewalls, DNS filtering solutions, and endpoint protection platforms ought to deny any traffic to phila.revenue-kw.cc and to its hosting IP 43.130.77.166. Continuous monitoring for new indicators, especially any changes in hosting or additional detections from security vendors, is recommended to maintain situational awareness and to update blocklists promptly.