phila[.]revenue-ns[.]cc

Analysis of the domain phila.revenue-ns.cc indicates active phishing infrastructure targeting municipal revenue or tax services. The domain was registered on September 18, 2025, through Dominet (HK) Limited, a registrar frequently associated with low-reputation registrations. As of July 29, 2026, the domain resolves to the IP address 170.106.51.191, which has been observed in prior phishing campaigns. Detection data from VirusTotal shows that 5 out of 91 security vendors flag this domain as malicious, suggesting moderate but not universal recognition of the threat.

The domain also appears on one security blocklist and is actively blocked by PhishDestroy, further corroborating its malicious classification. The naming convention (phila.revenue-ns.cc) implies an attempt to impersonate a Philadelphia revenue or tax authority, though no direct brand confirmation from page content or known phishing kits is available at this time. The exact nature of the phishing content remains unanalyzed, as no page title, SSL certificate details, or HTTP response data were provided. The domain's recent creation date and use of a subdomain structure (revenue-ns.cc) are consistent with tactics used to evade detection and lend false legitimacy.

Defenders should treat this domain as an elevated-risk phishing resource. Network-level blocking of 170.106.51.191 and the domain itself is recommended, along with monitoring for related subdomains or IP shifts. If internal logs show user interaction with this domain, immediate credential reset and endpoint scans should be conducted. Further investigation into the hosting provider for 170.106.51.191 may reveal additional linked infrastructure.