phila[.]revenue-vn[.]cc

Analysis of the domain phila.revenue-vn.cc indicates it is an active phishing infrastructure targeting U.S. tax-related credentials. The domain was registered on September 16, 2025, through Dominet (HK) Limited, a registrar frequently associated with high-risk domains. It currently resolves to IP address 170.106.51.191, which has been linked to other confirmed phishing campaigns in recent months. As of July 29, 2026, the domain appears on one security blocklist and is flagged by seven out of ninety-one security vendors on VirusTotal, confirming malicious classification.

The subdomain structure ('revenue-vn') suggests an attempt to mimic official revenue or tax authority portals, though the exact content of the site has not been analyzed. No specific phishing kit or brand target beyond the IRS thematic association is confirmed in available data. The domain remains active and unblocked by major browser-based protections, though it is currently blocked by PhishDestroy. Defenders should treat this domain as high-risk for credential harvesting targeting U.S. taxpayers or entities interacting with municipal revenue systems.

Network-level blocking of 170.106.51.191 and the domain is recommended. Further investigation into the hosting provider and associated infrastructure may reveal additional linked phishing domains. Given the domain's age and continued detection, it is likely part of a broader, persistent campaign rather than a short-lived operation.