phila[.]revenue-dh[.]cc

Analysis of the domain phila.revenue-dh.cc, observed on 29 July 2026, indicates an active generic phishing infrastructure. The domain was registered on 12 June 2026 through Dominet (HK) Limited, a registrar known to host malicious actors. DNS resolution points to the IPv4 address 170.106.51.191, which is the sole hosting endpoint associated with the campaign. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy mitigation service, confirming that at least one external sinkhole has identified it as malicious. VirusTotal scans show that 10 of 91 security vendors have flagged the domain, providing a modest but notable consensus of malicious classification.

The threat’s risk level is elevated and its status remains active, suggesting ongoing exploitation attempts. Publicly available intelligence does not include details on SSL certificates, HTTP response codes, page titles, or content analysis, so the exact landing page behavior remains unknown. The limited blocklist presence and the relatively low vendor detection count may reflect a recent introduction or a low‑profile targeting strategy. Nonetheless, the combination of registrar choice, dedicated IP, and external blocklist inclusion constitutes sufficient evidence for defensive action. Defenders should add phila.revenue-dh.cc to outbound and inbound filtering rules, enforce DNS sinkholing where possible, and monitor network traffic for connections to 170.106.51.191.

Continuous re‑scanning on VirusTotal or similar platforms is recommended to capture any escalation in detection rates. Organizations employing web‑proxy or secure web gateway solutions should ensure the domain is blocked at the proxy layer. Incident response teams should treat any credential submission or session initiated toward this domain as compromised and initiate credential reset procedures.