phila[.]revenue-zq[.]cc

The domain phila.revenue-zq.cc was registered on 2025-09-17 through Dominet (HK) Limited and currently resolves to the IPv4 address 43.130.77.166. VirusTotal reports that five of ninety-one participating security vendors have classified the host as malicious, indicating a moderate level of consensus among automated scanners. The domain is listed on a single external blocklist and has been explicitly denied by the PhishDestroy filtering service, confirming its active use in malicious campaigns. The risk rating assigned by internal assessment is elevated, and the operational status is marked as active. Infrastructure analysis shows a single A-record pointing to the aforementioned IP, with no additional CNAME or MX records observed in public DNS queries.

The registrar information suggests a Hong‑Kong based registration, a pattern often associated with fast‑flux or disposable hosting services. No SSL/TLS certificate details, HTTP response codes, or page‑title metadata have been published, leaving the content of the site unverified. Consequently, the precise phishing vector—whether credential harvesting, payment diversion, or other social‑engineering technique—remains uncertain. Defenders should immediately block DNS resolution for phila.revenue-zq.cc and deny traffic to 43.130.77.166 at the network perimeter.

Adding the domain to local and cloud‑based URL filtering lists will align with the existing PhishDestroy block. Continuous monitoring of the IP for any new hostnames or changes in DNS records is advised, as threat actors frequently rotate domains while retaining the same hosting infrastructure. Endpoint security solutions should be updated to reflect the five vendor detections reported by VirusTotal, ensuring that heuristic and signature‑based modules can flag any attempted connections.