phila[.]revergfv[.]cc

Analysis of the domain phila.revergfv.cc, created on 17 September 2025 and currently active, shows multiple indicators of compromise. VirusTotal reports that 15 of 91 security vendors have flagged the domain, demonstrating a moderate detection consensus. The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy service, confirming its recognition as a phishing vector. Infrastructure investigation reveals that the domain resolves to the IPv4 address 170.106.160.91; no additional hosting details or ASN information are provided in the current intelligence.

Registration data indicates the domain was registered through Dominet (HK) Limited, a registrar known to host a variety of malicious infrastructure. No public information is available regarding SSL certificates, HTTP response codes, page titles, or Safe Browsing status, leaving the exact content and targeting of the site unverified. The limited visibility of the site’s payload means that the specific phishing scenario (e.g., credential harvesting for a particular brand) cannot be confirmed at this time. Defenders should prioritize adding the domain and its resolved IP address to local blocklists and ensure that any outbound traffic to the address is denied.

Continuous monitoring of VirusTotal and other reputation services is advised, as additional detections may emerge. Organizations employing email filtering should retain the domain in deny lists to prevent user exposure, and security teams should consider threat‑intel sharing with peers to broaden detection coverage. The combination of vendor detections, blocklist presence, and registrar reputation justifies an elevated risk rating and warrants proactive mitigation.