phila[.]revenue-kp[.]cc

Analysis of the domain phila.revenue-kp.cc indicates that it is actively being used for generic phishing as of the report date 29 July 2026. The domain was registered on 16 September 2025 through Dominet (HK) Limited, a Hong‑Kong‑based registrar that frequently appears in malicious‑infrastructure observations. DNS resolution points to the IPv4 address 43.130.77.166; no additional hosting metadata such as ASN or geographic location is supplied in the current intelligence set. VirusTotal has recorded 14 positive detections out of 91 scanned security vendors, confirming that a subset of commercial scanners have identified malicious characteristics associated with the domain.

The feed PhishDestroy has already taken action to block the domain, and it is listed on a single external security blocklist, reinforcing the consensus that the domain should be considered hostile. The available data do not include HTTP response codes, SSL/TLS certificate details, page title, or any observed payload. Consequently, the exact phishing lures, credential‑harvesting mechanisms, or targeted brands remain unknown. Without visible content, defenders cannot confirm whether the site mimics a particular service or employs credential‑stealing forms.

This uncertainty underscores the need for continued monitoring of the domain’s activity and for any newly surfaced indicators such as URL redirects, payload hashes, or sinkhole traffic. Based on the current evidence, security operations should add phila.revenue‑kp.cc to URL filtering and DNS‑blocking policies, enforce the block on the associated IP address 43.130.77.166, and monitor the registrar for further domains that share the same registration pattern. Regular re‑scanning on VirusTotal or comparable multi‑engine platforms is recommended to capture any escalation in detection counts. Integration of the domain into internal threat‑intel feeds will also assist in correlating future suspicious activity across the network.