phila[.]revenue-zv[.]cc

Analysis of the domain phila.revenue-zv.cc shows an active generic phishing infrastructure that was registered on September 15, 2025 through Dominet (HK) Limited. DNS resolution points to the single IPv4 address 170.106.160.91, indicating a likely dedicated hosting environment for the malicious payload. The domain has been observed by VirusTotal, where 15 out of 91 security vendors submitted a detection, confirming that multiple independent scanners have identified malicious characteristics.

It also appears on one public security blocklist and is explicitly listed as blocked by the PhishDestroy service, demonstrating that threat‑intelligence feeds are already flagging this resource. No additional public data such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, or page title content are available at this time, leaving the exact landing‑page behavior and targeted brand undefined. Defenders should treat any traffic to or from 170.106.160.91 as suspicious and block communications at the network perimeter.

Email gateways should add phila.revenue-zv.cc to deny lists, and endpoint protection platforms should update signatures to include the 15 vendor detections reported by VirusTotal. Continuous monitoring of the IP address and the registrar’s WHOIS records is advised, as changes could indicate further expansion of the phishing campaign. Organizations should also verify that internal phishing‑simulation tools are not inadvertently whitelisting this domain, and consider sharing the indicator set with threat‑sharing communities to accelerate collective remediation.