phila[.]revenue-tr[.]cc

Analysis of the domain phila.revenue-tr.cc indicates that it is actively being used for malicious purposes. The domain was registered on September 15, 2025 through Dominet (HK) Limited, a registrar known to host a variety of short‑lived domains. DNS resolution points to the IPv4 address 170.106.51.191, which is the sole host associated with the domain in public records.

Independent threat‑intelligence platforms have flagged the domain; PhishDestroy has listed it as blocked, and it appears on one additional security blocklist, confirming that at least multiple defensive products recognize it as hostile. VirusTotal analysis shows that five of ninety‑one scanned scanners returned positive detections, reinforcing the suspicion of malicious intent. No public Safe Browsing, OTX, SSL, or HTTP status details have been disclosed, and the page title or specific phishing kit information has not been released, leaving the exact content of the landing page unverified.

The available evidence is sufficient for security teams to treat the domain as a high‑confidence phishing indicator. Defenders should immediately add 170.106.51.191 to network deny lists, block the domain at DNS resolvers, and monitor outbound connections for any attempted communications. Continuous re‑evaluation is recommended, as additional detections or content analyses may emerge, but current telemetry already warrants elevated risk classification and proactive mitigation.