phila[.]revenue-dk[.]cc

Analysis of the domain phila.revenue-dk.cc reveals infrastructure consistent with an active municipal tax-themed phishing campaign. The domain was registered on June 12, 2026, through Dominet (HK) Limited, a registrar frequently associated with low-cost, short-lived domains used in fraudulent schemes. It currently resolves to IP address 170.106.51.191, hosted on an infrastructure previously linked to credential harvesting pages targeting government and financial services. As of July 29, 2026, the domain appears on one security blocklist and is actively blocked by PhishDestroy, a specialized anti-phishing service.

VirusTotal analysis indicates that 12 of 91 security vendors have flagged the domain as malicious, though the specific detection labels and methodologies are not disclosed in available intelligence. The domain name itself suggests an attempt to impersonate a Philadelphia municipal revenue or taxation portal, leveraging the 'phila' prefix commonly associated with the city. However, no official branding or verified page content has been confirmed at this stage, and the exact nature of the phishing page—such as whether it collects login credentials, payment details, or tax document uploads—remains unanalyzed. No SSL certificate details, HTTP response codes, or page titles are currently available in the intelligence feed.

Defenders are advised to treat this domain as an elevated-risk indicator. Network-level blocking at the DNS or IP level is recommended, particularly for organizations in the public sector or financial services. Security teams should monitor for connections to 170.106.51.191 and the domain itself in proxy logs, endpoint telemetry, and email filtering systems. Given the domain’s recent creation and detection by multiple vendors, further analysis—including sandbox execution or passive DNS review—may help determine the full scope of the campaign and identify related infrastructure.