phila[.]revenue-xf[.]cc

The domain phila.revenue-xf.cc is currently flagged as an active generic phishing infrastructure with an elevated risk rating. Registration data shows the domain was created on September 17, 2025 and is listed under the registrar Dominet (HK) Limited. DNS resolution points to the IPv4 address 170.106.51.191, which is the sole hosting endpoint observed for this indicator. Threat intelligence feeds have placed the domain on a single security blocklist, and it is actively blocked by the PhishDestroy mitigation service.

VirusTotal analysis reports that five of ninety‑one scanned security vendors flagged the domain, indicating a modest but non‑trivial detection rate across automated scanners. No additional public metadata such as page title, SSL certificate details, or Safe Browsing verdicts are presently available. The limited detection footprint suggests the operator may be testing or staging the malicious site, yet the existing blocklist entries and vendor detections confirm malicious intent.

Defenders should prioritize adding the domain to local deny lists, enforce DNS sink‑holing for the associated IP address, and monitor for any new resolution changes or additional blocklist mentions. Continuous re‑query of VirusTotal and other reputation services is recommended to capture any escalation in detection prevalence. Organizations should also consider investigating inbound traffic logs for connections to 170.106.51.191 and correlating with user authentication attempts, as exploitation attempts are plausible given the phishing classification.