phila[.]revenue-nt[.]cc

phila.revenue-nt.cc was created on 17 September 2025 and is currently hosted at IP address 170.106.51.191. The registrar listed for the domain is Dominet (HK) Limited, a Hong‑Kong based registration service often seen in malicious infrastructure. The domain appears on a single public security blocklist and has been actively blocked by the PhishDestroy sink‑hole network, indicating that at least one defensive organization has observed malicious activity originating from the host. VirusTotal analysis shows that 10 out of 91 scanning engines have flagged the domain as malicious, confirming the presence of suspicious behavior despite a majority of scanners reporting no detection.

The limited blocklist presence suggests the domain is relatively new to the security community, which aligns with its registration date less than one year prior to the report date. Infrastructure analysis reveals that the sole IP address 170.106.51.191 does not resolve to any known reputable services and lacks publicly documented SSL certificates or HTTP response codes in the available intelligence. No page title or brand attribution has been published, so the exact phishing lure employed by the site remains unknown. The absence of additional contextual data such as Safe Browsing or Open Threat Exchange entries further limits attribution, but the combination of registrar, blocklist entry, and multi‑engine detections is consistent with a generic phishing campaign targeting users with fraudulent revenue‑related communications.

Defenders should immediately add phila.revenue-nt.cc to DNS and proxy blocklists, enforce outbound filtering to the IP 170.106.51.191, and monitor for any DNS queries or HTTP requests to the host. Because the domain is actively served through PhishDestroy, threat‑intel feeds that incorporate that sinkhole can be used to enrich detection rules. Continuous re‑scanning on VirusTotal or similar platforms is recommended to capture any changes in detection status.