phila[.]revenue-zp[.]cc

The domain phila.revenue-zp.cc has been identified as an active phishing operation as of July 29, 2026. Registration records confirm it was created on September 17, 2025, using the registrar Dominet (HK) Limited. The domain currently resolves to the IP address 43.130.77.166. Multiple security sources have flagged this domain: PhishDestroy has added it to their blocklist, and it appears on at least one public security blocklist. Additionally, VirusTotal data indicates that 14 out of 91 security vendors have classified this domain as malicious, underscoring a significant consensus in the security community regarding its risk profile.

At present, there is no evidence in the available intelligence to attribute this domain to a specific scam category or brand impersonation campaign. The precise content and tactics used on the associated phishing site have not yet been independently analyzed. However, the elevated detection rate and blocklist presence demonstrate a clear risk to users and organizations. The infrastructure, including the registrar and hosting, does not inherently increase or decrease risk based on current data, but defenders should note the use of a Hong Kong–based registrar, which may complicate certain takedown processes.

Security teams should immediately block phila.revenue-zp.cc at network and endpoint levels, monitor for related activity on IP 43.130.77.166, and review historical communications for potential compromise involving this domain. As the site remains active, further analysis should be conducted to determine the full scope of the threat. Any engagement with this domain should be considered high risk pending additional intelligence.