phila[.]revenue-zw[.]cc

The domain phila.revenue-zw.cc was registered on September 17, 2025 through Dominet (HK) Limited and currently resolves to the IPv4 address 43.130.77.166. Intelligence sources indicate that the domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis shows that five out of ninety‑one scanned security vendors flagged the domain, confirming the presence of malicious indicators.

No additional technical details such as page title, SSL certificate data, HTTP response codes, or Safe Browsing verdicts have been disclosed, leaving the exact content and targeting behavior of the site unverified. The limited detection coverage suggests the payload may be in an early deployment stage or employing evasion techniques that avoid broader detection. Defenders should immediately add phila.revenue-zw.cc to network and endpoint blocklists, enforce DNS filtering for the associated IP address, and monitor outbound traffic for connections to 43.130.77.166.

Continuous re‑scanning with VirusTotal and other multi‑engine services is advised to capture any shifts in detection rates. Analysts should also query threat‑intel feeds for related IoCs, such as similar domain patterns or hosting infrastructure, to identify potential campaign expansion. Until more information surfaces, the domain should be treated as a high‑confidence phishing indicator, and any user interaction with URLs under this domain must be blocked or redirected to a warning page.