phila[.]revenue-zt[.]cc

This investigation confirms that the domain phila.revenue-zt.cc is actively being used for generic phishing campaigns. The domain was registered through Dominet (HK) Limited on September 17, 2025 and currently resolves to the IPv4 address 43.130.77.166. VirusTotal scans show that 13 out of 91 security vendors have flagged the domain as malicious, indicating a moderate level of detection across the community.

The domain is listed on a single public security blocklist and is explicitly blocked by the PhishDestroy sinkhole, suggesting that at least one abuse‑mitigation service has observed malicious activity originating from this host. No additional public evidence such as page title, SSL certificate details, or HTTP response codes is presently available, so the exact content and lure techniques remain unverified. Analysts should assume the infrastructure is intended to harvest credentials or other sensitive information, consistent with the generic phishing classification.

Defensive actions recommended include adding the domain and its resolved IP address to outbound and inbound deny lists, monitoring DNS queries for repeated resolutions, and correlating internal logs for any authentication attempts to the domain. Continuous re‑evaluation is advised, as further indicators such as additional blocklist listings, changes in detection counts, or observed payloads may emerge.