revenue[.]refundfg[.]cc

The domain revenue.refundfg.cc was registered on September 15, 2025 through Dominet (HK) Limited and is currently marked as active with an elevated risk rating. DNS resolution points to the single IPv4 address 170.106.160.91, which is the only hosting endpoint observed for this infrastructure. The domain appears on one public security blocklist and is explicitly blocked by the PhishDestroy feed, indicating that at least one anti‑phishing service has taken automated action against it.

VirusTotal analysis shows that 12 of 91 scanning engines flagged the domain as malicious, providing additional corroboration of its malicious intent. No further public intelligence such as Safe Browsing alerts, Open Threat Exchange entries, SSL certificate details, HTTP status codes, or page title information is presently available, leaving the exact payload or victim‑targeting strategy unverified. The combination of recent registration, single‑IP hosting, blocklist inclusion, and multi‑engine detection points to a purpose‑built phishing operation, likely leveraging the domain name to entice victims with revenue‑related promises.

Defenders should consider adding revenue.refundfg.cc to outbound DNS deny lists, enforce URL filtering rules that block access to the resolved IP address, and monitor network traffic for HTTP requests to that address. Continuous re‑evaluation of the domain on VirusTotal and blocklist services is recommended to capture any changes in detection status. Organizations that employ email filtering should ensure that any messages referencing revenue.refundfg.cc are flagged or quarantined, and incident response teams should be prepared to investigate any potential credential harvesting attempts associated with this infrastructure.