phila[.]revenue-af[.]cc

The domain phila.revenue-af.cc was registered on June 12, 2026 and resolves to the IPv4 address 170.106.51.191. Registration was completed through Dominet (HK) Limited, a registrar with a history of hosting abusive infrastructure. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy mitigation service, indicating that at least one reputable anti‑phishing feed has identified it as malicious.

VirusTotal analysis shows that nine out of ninety‑one scanning engines have flagged the domain, providing independent confirmation of its hostile nature. The elevated risk rating assigned to the site aligns with the observed detection activity, although the relatively low blocklist count suggests that the campaign may be in early stages or limited in scope.

Defenders should treat any traffic to phila.revenue-af.cc as hostile, enforce DNS sink‑hole or blocklist rules to prevent resolution, and monitor outbound connections to the associated IP address for signs of credential harvesting or further command‑and‑control activity. Continuous re‑evaluation is advised, as additional detections may emerge as the campaign progresses.