phila[.]revepkol[.]cc

phila.revepkol.cc is an active generic phishing infrastructure observed as of July 29 2026. The domain resolves to the IPv4 address 170.106.160.91, which is the sole hosting point identified in the available data. Registration data shows the domain was created on 17 September 2025 through Dominet (HK) Limited, indicating a relatively short lifespan before detection. VirusTotal analysis records that 16 of 91 security vendors have flagged the domain, demonstrating a moderate level of consensus among detection engines.

The domain is listed on one public security blocklist and is actively blocked by the PhishDestroy service, confirming its presence on threat‑sharing feeds. The limited intelligence does not include SSL certificate details, HTTP response codes, page title, or additional host infrastructure, leaving the full scope of the phishing campaign uncertain. No evidence has been published regarding the targeted brand or the specific luring technique employed, so defenders cannot attribute the activity to a particular victim set. Nevertheless, the combination of a recent creation date, confirmed vendor detections, and inclusion on blocklists justifies treating the domain as high‑risk.

Defensive recommendations include immediately adding 170.106.160.91 to network‑level deny lists, configuring web‑proxy and DNS filtering to block phila.revepkol.cc, and sharing the indicator with internal threat‑intel teams and external clearinghouses. Continuous monitoring for any new sub‑domains or related IP addresses is advised, as the operators may pivot to additional infrastructure. Organizations should also consider sinkholing the domain, if feasible, to disrupt credential‑harvesting attempts while gathering further telemetry.