phila[.]revenue-nx[.]cc

The domain phila.revenue-nx.cc was registered on 15 September 2025 through Dominet (HK) Limited. DNS resolution points to the IPv4 address 170.106.160.91, which is the sole hosting endpoint observed for this indicator. The domain is currently classified as a generic phishing campaign with an elevated risk rating and remains active as of the report date 29 July 2026. Detection telemetry shows that 15 of 91 security vendors on VirusTotal have flagged the domain, indicating a moderate level of consensus among scanning engines.

In addition, the domain is listed on a single external blocklist and has been explicitly blocked by the PhishDestroy mitigation service, reinforcing its malicious reputation. The limited number of blocklist appearances suggests that the infrastructure may be newly deployed or otherwise low‑profile, but the presence of multiple vendor detections demonstrates that the payload or landing page exhibits characteristics commonly associated with credential‑stealing operations. No further intelligence such as page title, SSL certificate details, or HTTP response codes has been released, leaving the exact content and target brand of the phishing lure uncertain. Defenders should prioritize adding 170.106.160.91 to network‑level deny lists and ensure that any outbound connections to phila.revenue‑nx.cc are blocked at perimeter and endpoint controls.

Monitoring for DNS queries to this domain, as well as for any traffic to the associated IP, will aid in early detection of compromise attempts. Organizations employing email security gateways should update phishing signatures to include the domain and consider proactive user awareness messaging that references the observed malicious indicator. Continuous re‑evaluation is advised, as additional detections or blocklist listings may emerge as the campaign progresses.