phila[.]revenue-pf[.]cc

The domain phila.revenue-pf.cc was registered on September 16, 2025 through Dominet (HK) Limited and currently resolves to the IPv4 address 170.106.51.191. Independent scanning on VirusTotal shows that 15 of 91 security vendors have flagged the domain as malicious, indicating a moderate consensus of malicious intent among detection engines. The domain appears on one public security blocklist and is specifically blocked by the PhishDestroy filtering service, confirming that at least one external mitigation platform has taken action against it.

Observations suggest that the domain is being used for credential harvesting, consistent with its classification as a generic phishing threat. The presence of multiple vendor detections combined with blocklist inclusion demonstrates that the infrastructure is already recognized by defensive communities. However, no publicly available information on the site’s page title, SSL certificate details, or HTTP response codes has been disclosed, leaving the exact content and delivery mechanisms unverified.

Defenders should prioritize adding 170.106.51.191 to network deny lists and enforce DNS filtering for phila.revenue-pf.cc across all endpoints. Continuous monitoring of VirusTotal and blocklist feeds is advised to capture any changes in detection scores. Organizations should also educate users about unsolicited communications that may reference the domain, reinforcing the need to verify URLs before credential entry.