phila[.]revenue-cx[.]cc

The domain phila.revenue-cx.cc was registered on June 12 2026 through Dominet (HK) Limited and currently resolves to the IPv4 address 170.106.51.191. VirusTotal scans show that seven out of ninety‑one security vendors have flagged the domain as malicious, a signal that aligns with its classification as a generic phishing site. Independent threat‑intelligence feeds have added the address to a security blocklist and the PhishDestroy service reports the domain as blocked, confirming that multiple external platforms consider it hostile.

The infrastructure is marked as active and assigned an elevated risk rating, suggesting ongoing use in credential‑stealing campaigns. No public SSL certificate information, HTTP response codes, Safe Browsing verdicts, or Open Threat Exchange (OTX) entries are presently available for this host, limiting the depth of technical attribution. Defenders should therefore enforce a deny‑list rule for phila.revenue-cx.cc at perimeter devices, DNS resolvers, and proxy servers.

Monitoring of traffic to the resolved IP address 170.106.51.191 is advised, as the host may serve additional malicious payloads or act as a command‑and‑control relay. Organizations should also consider sharing observed indicators with industry‑wide blocklists to improve collective detection. Continuous re‑evaluation is recommended, as further analysis of the web server response or TLS configuration could reveal additional tactics used by the actors behind this infrastructure.