revenue[.]com-payeml[.]vip

The domain revenue.com-payeml.vip was registered on September 27, 2025 through Gname.com Pte. Ltd. and is delegated to the Cloudflare name servers dion.ns.cloudflare.com and laila.ns.cloudflare.com. DNS resolution points to the IP address 172.67.195.66, which is a Cloudflare edge node commonly used to mask the true origin of malicious web infrastructure. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service, indicating that at least one reputable anti‑phishing feed has identified it as hostile. VirusTotal analysis reports that 14 of 91 scanned security vendors flagged the domain, providing independent confirmation of its malicious reputation. The threat is classified as generic phishing and the domain remains active as of the report date, July 29, 2026.

Analysis of the available indicators suggests a typical phishing deployment: a freshly created domain, use of a CDN provider to hide hosting details, and rapid inclusion on anti‑phishing feeds. The blocklist presence and multi‑vendor detections collectively point to credential‑harvesting activity, although the exact lure, target brand, or page content has not been disclosed in public intelligence. Consequently, the specific phishing vector (e.g., login credential capture, payment credential request) remains uncertain. No information on SSL certificate parameters, HTTP response codes, or page title has been released, limiting visibility into the site’s operational characteristics. Given the demonstrated malicious activity, defenders should treat revenue.com-payeml.vip as hostile.

Recommended mitigations include adding the domain to DNS‑based deny lists, blocking outbound traffic to its resolved IP address, and configuring email security gateways to quarantine messages that reference the domain. Network monitoring should watch for DNS queries to the domain and for any traffic to the associated Cloudflare edge IP.