phila[.]revenhjl[.]cc

Analysis as of July 29 2026 indicates that the domain phila.revenhjl.cc is actively leveraged in a generic phishing campaign. The domain was registered on September 16 2025 through Dominet (HK) Limited, a registrar known to host a variety of malicious actors. DNS resolution points to the IPv4 address 170.106.160.91, which is currently listed on a single security blocklist and has been added to the PhishDestroy blocklist. VirusTotal scans show that 14 of 91 security vendors have flagged the domain, suggesting a moderate level of detection across the ecosystem.

The domain’s risk rating is elevated, and its status remains active, implying ongoing use. Publicly available intelligence does not include a retrieved page title, SSL certificate details, HTTP response codes, or Safe Browsing/OTX entries, so the exact content served by the site cannot be confirmed at this time. The lack of additional blocklist listings or broader detection may reflect limited exposure or recent deployment.

Defenders should prioritize adding phila.revenhjl.cc to local deny lists and ensure that any inbound or outbound traffic to the associated IP address 170.106.160.91 is blocked. Monitoring for new detections on VirusTotal and other aggregators is advised, as well as periodic re‑resolution of the domain to detect any potential hosting changes. Organizations employing email filters should treat messages containing URLs to this domain as malicious, and incident response teams should consider the domain a confirmed indicator of compromise when encountered in logs.