phila[.]reveblonv[.]cc

Analysis of the domain phila.reveblonv.cc shows a newly registered infrastructure that is actively being used for phishing. The domain was created on June 12, 2026 and is registered through Dominet (HK) Limited, indicating a Hong Kong‑based registrar. DNS resolution points to the IPv4 address 170.106.160.91, which is the sole hosting endpoint observed for this campaign.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one anti‑phishing feed has flagged it as malicious. VirusTotal scans report that 15 of 91 security vendors label the domain as malicious, providing independent confirmation of its threat status. The current risk level is elevated and the status is active, meaning the site is likely still serving phishing content.

No public information is available regarding the site’s SSL certificate, HTTP response codes, or page title, and no additional intelligence such as OTX references or Safe Browsing entries has been disclosed. Defenders should immediately block traffic to phila.reveblonv.cc and its resolved IP address 170.106.160.91 at perimeter defenses, update intrusion detection signatures, and add the domain to internal blocklists. Continuous monitoring of the IP for any pivot activity is advised, as well as periodic re‑scans to capture any changes in vendor detections.