phila[.]revebmkjh[.]cc

This investigation examines the domain phila.revebmkjh.cc, which was created on 12 June 2026 and is currently classified as an active generic phishing threat with an elevated risk rating. The domain is registered through Dominet (HK) Limited, a registrar based in Hong Kong, and resolves to the IPv4 address 170.106.160.91. VirusTotal has recorded that 16 of 91 security vendors have flagged the domain, indicating a moderate level of detection across the security community. The domain appears on a single known security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, reinforcing the consensus that the site is malicious.

Infrastructure analysis confirms that the single IP address is the sole resolution target, suggesting a centralized hosting model that can be readily blocked at the network perimeter. No public SSL certificate details, HTTP status codes, or page title information are presently available, limiting insight into the specific content or brand impersonated by the site. Consequently, the precise phishing lure employed remains uncertain, and further dynamic analysis would be required to ascertain the credential‑collection mechanisms. Defenders are advised to add phila.revebmkjh.cc and its hosting IP 170.106.160.91 to domain and IP blocklists, enforce DNS sinkholing where possible, and monitor outbound traffic for connections to this address.

Continuous re‑scanning with multi‑vendor services is recommended to capture any changes in detection patterns. Organizations should also incorporate the registrar information (Dominet (HK) Limited) into threat‑intel feeds to flag future domains that share this registration profile. The elevated risk designation warrants prioritization in incident‑response workflows and user‑awareness campaigns.