phila[.]revenue-nk[.]cc

Analysis indicates that the domain phila.revenue-nk.cc was registered on 16 September 2025 through Dominet (HK) Limited and currently resolves to the IPv4 address 170.106.51.191. The domain is listed on a single security blocklist and is actively blocked by the PhishDestroy service, confirming that it is being treated as malicious by at least one reputable defensive platform. VirusTotal has returned detections from seven of ninety‑one scanning engines, providing independent confirmation of malicious activity. The presence of multiple detections, combined with the blocklist entry, aligns with the classification of a generic phishing operation.

Infrastructure observations are limited to the hosting IP and registrar information; no public SSL certificate details, HTTP response codes, or page title metadata have been disclosed in the available intelligence. Consequently, the exact payload, lure technique, or targeted brand cannot be verified at this time. The lack of additional contextual data such as page content or observed credential‑stealing forms means that the full scope of the campaign remains uncertain. Defenders should prioritize preventative controls.

Blocking the IP address 170.106.51.191 at network borders will stop direct connections to the host. Adding the domain and its sub‑domains to DNS‑based deny lists and ensuring that web‑filtering solutions reference the blocklist entry will reduce user exposure. Security operations teams should monitor outbound traffic for connections to the listed IP and generate alerts for any authentication attempts to services that may be mimicked by the phishing site. Continuous re‑evaluation is recommended, as additional indicators—such as SSL fingerprints, HTTP status codes, or page titles—may emerge from future crawls.