phila[.]revenue-kd[.]cc

Analysis of phila.revenue-kd.cc indicates an active generic phishing infrastructure targeting revenue-related services. The domain was registered on September 16 2025 through Dominet (HK) Limited, a registrar based in Hong Kong. DNS resolution points exclusively to the IPv4 address 43.130.77.166, which is the sole host observed for this indicator. Reputation services have taken notice: PhishDestroy has added the domain to its blocklist, and it appears on an additional security blocklist, bringing the total count of blocklist listings to one. VirusTotal scans have returned 16 positive detections out of 91 submitted security vendors, confirming that a significant portion of the scanning ecosystem classifies the domain as malicious.

The risk level is assigned as elevated, and the campaign remains active as of the report date, July 29 2026. While the available intelligence confirms malicious intent, several operational details remain unknown. No publicly released page title, SSL certificate information, or HTTP response codes have been disclosed, limiting insight into the specific phishing lure or credential‑harvesting mechanisms employed. The hosting environment beyond the single IP address has not been correlated with known threat actor infrastructure, and no attribution to a broader campaign or toolkit has been identified. Defenders should prioritize immediate containment actions.

The domain should be added to local deny lists and enforced through perimeter firewalls or secure web gateways. Security solutions that integrate VirusTotal or similar multi‑vendor reputation feeds must be configured to block any request that matches the 16 positive detections. Network monitoring should include traffic to 43.130.77.166 and any associated sub‑domains, and incident response teams should advise users to avoid interactions with any communications purporting to originate from this domain.