phila[.]revenue-rw[.]cc

This domain, phila.revenue-rw.cc, is actively flagged as a phishing threat targeting municipal or city revenue services. Registered on September 17, 2025, through Dominet (HK) Limited, the domain resolves to the IP address 170.106.51.191. As of July 29, 2026, it appears on one security blocklist and is blocked by PhishDestroy. VirusTotal reports 12 of 91 security vendors detecting the domain as malicious, indicating moderate but not universal consensus among detection engines.

The domain's infrastructure, including its hosting provider and registrar, aligns with patterns observed in phishing campaigns, though the specific brand or service being impersonated beyond a generic revenue portal remains unconfirmed due to lack of detailed page analysis. Defenders should treat this domain as an elevated risk due to its active status, detection by multiple security vendors, and association with a known phishing blocklist. Immediate action includes blocking the domain and its resolving IP at the network perimeter, as well as monitoring for any internal connections to 170.106.51.191.

Given the domain's age (nearly 10 months old), it may represent a persistent or recycled phishing resource rather than a short-lived campaign. No SSL certificate or HTTP response data is currently available in the provided intelligence, limiting further assessment of its operational security or encryption practices. Organizations should prioritize user awareness, particularly for employees handling municipal or tax-related communications, as this domain may be used in targeted credential harvesting or financial fraud attempts.