phila[.]revenue-kl[.]cc

Analysis indicates that the domain phila.revenue-kl.cc is currently active and associated with a generic phishing campaign. The domain was registered on September 16, 2025 through Dominet (HK) Limited, a registrar based in Hong Kong. Infrastructure observation shows that the domain resolves to the IPv4 address 170.106.51.191; no additional hosting details are available. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy sinkhole.

VirusTotal reports that five of ninety‑one antivirus and URL scanners have flagged the domain as malicious, reinforcing the suspicion of phishing activity. The threat is classified as elevated risk, consistent with the presence of multiple detections and active blocking. No public SSL certificate information, HTTP response codes, or page title data have been disclosed, leaving the exact landing page content unverified. Defenders should add phila.revenue-kl.cc to network blocklists, enforce DNS filtering, and monitor outbound traffic for connections to 170.106.51.191.

Email security gateways should be tuned to flag any messages that reference the domain or its sub‑domains, and incident response teams should treat any credential submissions to this site as compromised. Ongoing monitoring of the IP address and any future VirusTotal or blocklist updates is recommended to capture changes in detection rates. Given the limited visibility into the payload, the precautionary actions listed above represent the most reliable mitigation steps.