phila[.]revenue-ef[.]cc

Analysis of the domain phila.revenue-ef.cc indicates active credential-phishing infrastructure targeting municipal or revenue-service users. The domain was registered on June 12, 2026, through Dominet (HK) Limited, a registrar frequently associated with short-lived phishing campaigns. As of July 29, 2026, the domain appears on one security blocklist and is flagged by 11 of 91 security vendors on VirusTotal, suggesting moderate but growing detection.

No hosting IP, autonomous system, or SSL certificate details are currently available in the observable evidence, limiting attribution to specific bulletproof providers. The domain remains unlisted in Google Safe Browsing and AlienVault OTX at the time of this report, though this does not preclude malicious intent. Defenders should treat this domain as elevated risk due to its recent registration, low-to-moderate detection coverage, and association with a registrar historically linked to phishing operations.

Network-level blocking is recommended pending further analysis of the site’s content, which has not yet been classified for specific brand impersonation or phishing kit usage. Monitoring for additional detections or blocklist additions is advised, as the domain’s infrastructure aligns with patterns observed in credential-harvesting campaigns.