chase-bnk[.]com

Analysis of chase-bnk.com shows a clear infrastructure pattern consistent with a brand‑impersonation campaign targeting Chase customers. The domain was registered on March 22, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IPv4 address 198.12.66.123, which belongs to AS36352 HostPapa located in the United States. The hosting provider’s name servers are ns1.host-forest.com and ns2.host-forest.com, indicating the site was deployed on a shared‑hosting platform rather than a dedicated infrastructure. An SSL certificate issued by GoDaddy.com (GoDaddy TLS Intermediate CA DV – R1v1) was present, a common choice for short‑lived malicious sites that require HTTPS without raising immediate suspicion.

The HTTP response returned a generic "Index of /" page title, providing no functional content but confirming the server was reachable before the site was taken offline. VirusTotal scans flagged the domain on 15 of 95 security engines, and the site appears on a single external blocklist, where it is listed by PhishDestroy. AlienVault OTX identified the domain in one threat‑intel pulse, further corroborating its malicious reputation. Gridinsoft’s trust score of 0 / 100 reflects a very low credibility rating.

The site is currently offline, which limits active reconnaissance but does not eliminate residual risk from cached content, email campaigns, or previously harvested credentials. Defenders should continue to block the domain at perimeter filters, monitor for any residual URLs referencing the IP address 198.12.66.123, and update user‑education materials to warn Chase customers about potential phishing attempts. Threat‑intel feeds should be refreshed to capture any re‑use of the same infrastructure in future campaigns, and any residual DNS records should be watched for re‑registration.