phila[.]revenue-lz[.]cc

Analysis of the domain phila.revenue-lz.cc shows an active generic phishing operation with an elevated risk rating. The domain was registered through Dominet (HK) Limited on September 15, 2025 and currently resolves to the IPv4 address 170.106.160.91. Threat intelligence indicates that the domain is blocked by PhishDestroy and appears on one external security blocklist.

VirusTotal scans have resulted in 14 of 91 security vendors flagging the domain as malicious, confirming a consensus of detection across multiple antivirus and URL‑reputation services. No public information is available regarding SSL certificate details, HTTP response codes, page title, or additional hosting attributes, leaving those aspects of the infrastructure unverified. Defenders should immediately add phila.revenue-lz.cc to local and network‑level deny lists, enforce DNS‑level blocking, and monitor traffic to the associated IP address for any anomalous connections.

Continuous re‑evaluation is advised, as further analysis may reveal additional indicators such as payload delivery mechanisms or credential‑harvesting pages. Organizations should also consider sharing observed indicators with broader threat‑sharing communities to improve collective detection of similar phishing campaigns.