phila[.]reveqsdf[.]cc

Analysis indicates that the domain phila.reveqsdf.cc was registered on September 17 2025 through Dominet (HK) Limited, a Hong Kong‑based registrar frequently used by malicious operators. The domain resolves to the IPv4 address 170.106.160.91, which is the sole hosting point observed in current DNS queries. It appears on a single security blocklist and is actively blocked by the PhishDestroy service, confirming that at least one reputable anti‑phishing feed has identified it as malicious. VirusTotal scans have returned detections from 14 of 91 AV engines, reinforcing the suspicion of malicious activity.

The threat is classified as generic phishing, with an elevated risk rating and an active status as of the report date. Uncertainty remains regarding the specific phishing campaign details, such as the targeted brand, the content served, or any additional infrastructure components, because no page title, SSL certificate, or HTTP response information has been disclosed. Consequently, defenders lack visibility into the exact lure or credential‑harvesting mechanism employed. Defensive recommendations include adding the domain and its resolving IP address to local deny lists, configuring web filtering solutions to block any HTTP or HTTPS requests to phila.reveqsdf.cc, and monitoring DNS logs for queries to the associated IP.

Network intrusion detection systems should flag outbound connections to the address, and endpoint protection platforms should enforce the VirusTotal detection verdicts. Organizations should also consider sharing the indicator set with threat‑intel sharing communities to improve collective detection. Continuous re‑evaluation is advised, as further reconnaissance may reveal additional payloads or hosting changes.