phila[.]revenue-ap[.]cc

Analysis of the domain phila.revenue-ap.cc indicates that it is actively being used for phishing operations and should be treated as a confirmed malicious site. The domain was registered on June 12, 2026 through Dominet (HK) Limited, a registrar known for low‑cost registrations and limited verification. It resolves to the single IPv4 address 170.106.51.191, which is the only hosting endpoint observed for this campaign. No additional infrastructure such as CDN or secondary IPs has been identified, suggesting a simple hosting setup that can be quickly taken offline if required.

The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, confirming that external threat‑intel feeds recognize it as abusive. VirusTotal scans show that 5 out of 91 security vendors flag the domain as malicious, providing independent corroboration of its phishing nature despite the relatively low detection count. The threat is classified as generic phishing, with an elevated risk rating and an active status as of the report date, July 29, 2026.

Defenders should add phila.revenue-ap.cc to network deny lists, update URL filtering rules, and monitor outbound connections to the IP 170.106.51.191 for any anomalous traffic. Continuous re‑evaluation is advised, as additional indicators such as SSL certificate details, HTTP response codes, or page content have not yet been disclosed. Organizations receiving phishing attempts that reference revenue‑related services should treat any communications originating from this domain as fraudulent and advise users to avoid interaction.