phila[.]revenue-hf[.]cc

The domain phila.revenue-hf.cc was registered on 17 September 2025 through Dominet (HK) Limited and resolves to the IPv4 address 170.106.51.191. Since its creation, the domain has been observed in multiple security feeds. PhishDestroy has listed the domain as blocked, and it appears on at least one external blocklist. VirusTotal analysis shows that 15 of 91 scanned security engines raise detections against the domain, indicating a non‑trivial level of malicious activity.

The current evidence points to a generic phishing campaign that likely attempts to harvest credentials, although the exact target brand or page content has not been publicly disclosed. No public SSL certificate information, HTTP response codes, or Safe Browsing verdicts are available at this time, and the page title and any associated landing‑page characteristics remain unverified. The hosting IP 170.106.51.191 is not presently linked to a known benign service, further supporting the suspicion that the infrastructure is purpose‑built for malicious use. Defenders should add phila.revenue-hf.cc to internal block and alert lists, enforce outbound DNS filtering, and monitor network traffic for connections to the associated IP address.

Continuous re‑scanning with VirusTotal and other sandbox services is advised to capture any evolving payloads. Organizations that employ email security gateways should treat any messages containing links to this domain as malicious and quarantine them. Incident response teams should collect any related phishing emails, capture network flows to the IP, and consider sink‑holing the domain to disrupt attacker operations while gathering intelligence.