phila[.]revenue-jl[.]cc

On July 29 2026, the domain phila.revenue-jl.cc was identified as an active generic phishing infrastructure. The domain was registered on 16 September 2025 through Dominet (HK) Limited, a registrar known to host a variety of short‑lived malicious sites. DNS resolution points to the IPv4 address 170.106.51.191, which is the sole host observed for this indicator. The address currently appears on one public security blocklist and is listed by the PhishDestroy feed as blocked, indicating that at least one anti‑phishing service has taken remediation action.

VirusTotal has analyzed the domain with 91 security vendors; six vendors returned a positive detection, reinforcing the suspicion of malicious intent. The domain is classified as a generic phishing campaign and assigned an elevated risk rating, consistent with its recent creation date and limited detection history. Evidence confirms that the domain is reachable, but no public page title, SSL certificate details, HTTP status codes, or additional payload information have been disclosed. Consequently, the precise phishing template, targeted brand, or credential‑harvesting technique remains unknown.

The limited detection count suggests the campaign may be in early deployment or employing low‑profile hosting to evade broader surveillance. Defenders should add 170.106.51.191 to endpoint and network blocklists, monitor DNS queries for phila.revenue-jl.cc, and enforce existing phishing‑defense layers such as URL filtering and email authentication. Continuous re‑scanning on VirusTotal and inclusion in threat‑intel sharing platforms are recommended to capture any escalation in detection rates. Organizations that employ DNS‑sinkhole or threat‑intelligence‑driven firewalls should prioritize blocking this indicator while awaiting further forensic artefacts.