phila[.]revenue-sc[.]cc

On July 29, 2026 the domain phila.revenue-sc.cc is classified as an active generic phishing infrastructure with an elevated risk rating. The domain was registered through Dominet (HK) Limited on 15 September 2025 and currently resolves to the IPv4 address 170.106.160.91. VirusTotal has recorded 16 of 91 security vendors flagging the domain, indicating a moderate level of consensus among automated scanners that the host is malicious. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one community‑maintained blacklist has taken remediation action.

The elevated risk designation reflects the combination of vendor detections, recent creation date, and active blocklist status, which together suggest that the domain is being used in ongoing credential‑stealing campaigns rather than as a dormant placeholder. No further public indicators such as page titles, SSL certificate details, Safe Browsing verdicts, or brand targeting are available in the current intelligence set, leaving the exact lure and credential‑capture mechanisms undocumented. Defenders should treat any network traffic to or from 170.106.160.91 as potentially hostile, enforce outbound filtering to block HTTP/S connections to the domain, and add the domain to internal blocklists. Continuous monitoring of the IP reputation and periodic re‑scans on VirusTotal are advised to capture any evolution in vendor detections.

Correlation with internal logs for login attempts, credential submissions, or anomalous URL accesses that contain the “phila.revenue-sc.cc” substring will help surface compromised accounts. Organizations should also review DNS logs for queries to this domain and consider implementing DNS‑level sinkhole redirects to a controlled response that can capture attempted connections for forensic analysis.