phila[.]revenue-tl[.]cc

Analysis of the domain phila.revenue-tl.cc indicates an active phishing infrastructure targeting municipal tax or revenue services, as suggested by the domain naming convention. Registered on September 17, 2025, through Dominet (HK) Limited, the domain resolves to the IP address 170.106.51.191, which has been associated with other suspicious activities. As of July 29, 2026, the domain is flagged by 12 of 91 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy.

The elevated risk classification is supported by these detections, though the exact nature of the phishing content remains unverified due to limited public analysis of the site's payload. Infrastructure review reveals the domain is hosted on an IP with no additional context regarding its autonomous system or geolocation beyond the registration details. No SSL certificate data, HTTP response codes, or page titles are currently available to further clarify the site's operational status or brand impersonation.

Defenders are advised to treat this domain as a potential threat vector for credential harvesting or financial fraud targeting municipal taxpayers. Network-level blocking is recommended, particularly for organizations in sectors handling tax-related communications. Continuous monitoring for changes in detection status or hosting infrastructure is advised, as the domain remains active and may evolve in its targeting methods.