phila[.]revenue-ru[.]cc

On July 29, 2026 the domain phila.revenue-ru.cc is listed as active with an elevated risk rating. The domain was registered on September 18, 2025 through Dominet (HK) Limited, a registrar known for allowing rapid registration of short‑lived sites. DNS resolution points to the IPv4 address 170.106.51.191, which is the sole hosting endpoint observed for this indicator. Threat intelligence platforms have flagged the domain as malicious: VirusTotal reports 7 of 91 scanned vendors labeling it as malicious, and the domain is currently listed on one public security blocklist.

Additionally, the PhishDestroy service has added the domain to its blocklist, confirming that it is being used for phishing‑related campaigns. No public information is available regarding the site’s SSL certificate, HTTP response codes, or page title, indicating that those artefacts have not yet been captured or released. The limited visibility suggests that the infrastructure may be short‑lived or that the operators are employing fast‑flux techniques to evade detection. Defenders should block the domain at network perimeter devices, update DNS sinkhole feeds, and add the resolving IP address 170.106.51.191 to host‑based deny lists.

Monitoring for credential‑harvesting attempts targeting the same brand or similar domain patterns is advised, as the naming convention implies an attempt to impersonate revenue‑related services. Continuous re‑scanning with multi‑engine platforms such as VirusTotal is recommended to capture any changes in payload or hosting. Organizations should also consider user‑education campaigns that highlight the risk of unsolicited communications referencing revenue or tax authorities, given the domain’s naming strategy. Until further forensic detail is released, the domain remains a credible threat vector and should be treated accordingly.