phila[.]revenue-ml[.]cc

Analysis of the domain phila.revenue-ml.cc shows an active generic phishing infrastructure that was registered on September 16, 2025 through Dominet (HK) Limited. The domain resolves to the IPv4 address 170.106.51.191, which is currently the only observable host for this campaign. Detection services on VirusTotal have flagged the domain in five out of ninety‑one security vendor scans, indicating that at least a subset of commercial tools recognize malicious behavior associated with the host. The domain has been listed on a single security blocklist and is explicitly blocked by the PhishDestroy mitigation platform, confirming that defensive operators have already taken containment steps.

The risk level is elevated, reflecting the combination of recent creation, active status, and partial detection coverage. What remains uncertain includes the specific payload or credential‑harvesting pages hosted at the address, as no page title or SSL fingerprint has been publicly disclosed. Likewise, the broader command‑and‑control architecture, if any, has not been identified beyond the single IP endpoint.

Defenders should prioritize adding phila.revenue-ml.cc and its resolving IP 170.106.51.191 to outbound and inbound firewall deny lists, enforce DNS sinkholing for the domain, and monitor network traffic for any connections to the host. Continuous ingestion of updated threat feeds that reference this domain will aid in rapid detection of any future redeployment or related sub‑domains. Organizations should also audit email gateway logs for messages containing the domain or its variants, and consider tightening URL filtering rules for newly registered .cc TLDs associated with low‑reputation registrars such as Dominet.