phila[.]reveklji[.]cc

Analysis indicates that the domain phila.reveklji.cc was registered on 16 September 2025 through Dominet (HK) Limited, a registrar based in Hong Kong. The domain resolves to the IPv4 address 170.106.160.91, which is currently the sole hosting endpoint observed. Reputation services have placed the domain on one security blocklist and it is actively blocked by the PhishDestroy filtering service. VirusTotal scans show that 15 of 91 security vendors have flagged the domain as malicious, reflecting a moderate level of detection consensus.

The presence of multiple independent detections, combined with blocklist inclusion, suggests the domain is being used for malicious activity, consistent with the generic phishing classification supplied in the intelligence brief. No additional public data such as SSL certificate details, HTTP response codes, or page title information is available at this time, leaving the exact content of the hosted site unverified. The lack of further telemetry limits the ability to attribute specific attack vectors or victim targeting.

Defenders should consider the domain as high‑risk and enforce blocklist rules that include it, monitor outbound DNS queries for lookups to 170.106.160.91, and incorporate the domain into intrusion detection signatures. Organizations employing web filtering should ensure that PhishDestroy or equivalent services remain enabled, and security teams ought to query VirusTotal for any new scan results that may adjust the detection count. Continuous observation of the IP address for changes in hosting or additional malicious indicators is recommended, as is periodic re‑evaluation of the domain's reputation as more data becomes available.