phila[.]revenue-gi[.]cc

Analysis as of July 29, 2026 indicates that the domain phila.revenue-gi.cc is actively being used for phishing operations and is classified with an elevated risk level. The domain was registered on September 15, 2025 through Dominet (HK) Limited, and DNS resolution points to the single IPv4 address 43.130.77.166. VirusTotal has recorded detections from 14 of 91 security vendors, demonstrating a measurable consensus among scanning engines that the domain is malicious.

The domain appears on one external security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing service is already filtering traffic to it. No further infrastructure details such as ASN, hosting provider, or geographic location are disclosed in the available intelligence, and the current HTTP response code, TLS certificate status, or page title have not been published, leaving those aspects of the site’s surface unknown. Given the confirmed phishing classification, the elevated risk rating, and the existing vendor detections, defenders should add phila.revenue-gi.cc to deny‑list configurations at network perimeters, proxy servers, and endpoint protection solutions.

Continuous monitoring of the associated IP address 43.130.77.166 is advised, as any change in hosting or additional sub‑domains could indicate campaign expansion. Organizations should also ensure that any user‑facing authentication portals are protected by multi‑factor authentication and that employees are educated on the risks of unsolicited credential requests, as the domain’s intent aligns with credential harvesting.