phila[.]revenue-kc[.]cc

The domain phila.revenue-kc.cc was registered on 16 September 2025 through Dominet (HK) Limited and currently resolves to the IPv4 address 43.130.77.166. Automated scanning on VirusTotal shows that 16 of 91 security vendors have flagged the domain as malicious, indicating a moderate level of consensus among detection engines. The domain is listed on a single public security blocklist and has been actively blocked by the PhishDestroy mitigation service, confirming that at least one downstream sink has recognized it as a threat. The threat type is classified as generic phishing, and the operational status is marked as active with an elevated risk rating.

Infrastructure analysis reveals a single A‑record pointing to the aforementioned IP, which is hosted in a data centre that does not publicly disclose a dedicated ASN or country attribution in the supplied intelligence. No SSL certificate details, HTTP response codes, or page‑title information have been disclosed, so the content served by the host remains unverified. The lack of additional hosting footprints or associated domains limits attribution but the combination of registrar, recent creation date, and the detection count aligns with typical phishing infrastructure patterns observed in recent campaigns. Defenders should prioritize immediate blocking of phila.revenue-kc.cc at perimeter defenses and ensure that any outbound traffic to the IP 43.130.77.166 is denied.

Monitoring of DNS queries for this domain can provide early warning of attempted exploitation. Given the active status and elevated risk, organizations should also consider adding the domain to internal blocklists and sharing the indicator with threat‑sharing platforms. Continued observation of the IP address for changes in reputation or the emergence of additional malicious payloads is advised, as further evidence may surface in subsequent scans.