phila[.]revenjytb[.]cc

The domain phila.revenjytb.cc is currently active and has been classified as a generic phishing threat. Registration data shows the domain was created on September 16, 2025 and was registered through Dominet (HK) Limited, a registrar based in Hong Kong. DNS resolution points to the IPv4 address 170.106.160.91, which is the sole host observed for this domain.

VirusTotal analysis indicates that 14 of 91 security vendors have flagged the domain, suggesting a measurable level of malicious confidence across multiple detection engines. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one commercial phishing mitigation platform has taken protective action. No additional intelligence such as SSL certificate details, HTTP response codes, page titles, or brand references is presently available, limiting the scope of observable indicators.

Defenders should prioritize adding the domain to internal DNS and web filtering blocklists, enforce sinkholing of the associated IP address, and monitor for any outbound connections to 170.106.160.91 from internal hosts. Continuous telemetry collection on DNS queries and HTTP requests to this domain is recommended to detect any resurgence or related infrastructure changes. Given the elevated risk rating and the observed vendor consensus, proactive containment and ongoing observation are advised to mitigate potential credential harvesting or data exfiltration attempts.