phila[.]revenue-es[.]cc

On 12 June 2026 the domain phila.revenue-es.cc was registered through Dominet (HK) Limited. The domain resolves to the IPv4 address 170.106.51.191, which is the only hosting endpoint observed for this indicator. VirusTotal records show five positive detections out of ninety‑one submitted scanners, confirming that a subset of security engines have flagged the host as malicious. The domain appears on one public security blocklist and has been actively blocked by the PhishDestroy sinkhole, demonstrating that defensive feeds are already distributing indicators for remediation.

The threat is classified as generic phishing and carries an elevated risk rating. No publicly available data on SSL/TLS certificates, HTTP response codes, page title, Google Safe Browsing, or OTX references has been published for this host, leaving the exact content and attack vector unverified. The absence of such details limits the ability to assess certificate reputation or page‑level indicators.

Analysts should continue to monitor the IP address 170.106.51.191 for changes in activity, enforce deny‑list rules for the domain across perimeter and DNS filtering solutions, and consider adding the host to internal blocklists. Given the presence of multiple vendor detections and existing blocklist entries, traffic to this domain should be treated as hostile until a definitive takedown is confirmed. Additional investigative steps, such as payload collection, sandbox execution, and WHOIS verification, are recommended to identify any phishing kit or credential‑harvesting mechanisms that may be employed.