post[.]ch-zahlungssystem[.]sale

The domain post.ch-zahlungssystem.sale was registered on February 21, 2026 and currently resolves to the IPv4 address 172.67.174.247, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The domain’s SSL certificate is identified as WE1, indicating a valid TLS layer but offering no additional trust signals. VirusTotal has recorded 15 positive detections out of 93 scanned security vendors, confirming that multiple independent scanners flag the domain as malicious. It appears on a single public blocklist and is actively blocked by the PhishDestroy service, reinforcing the consensus that the domain is being used for phishing.

The threat classification supplied is “generic phishing,” and the risk level is elevated. The site has been taken offline, as indicated by the status flag, and no HTTP response body or page title is available for further analysis. Defenders should add the IP address 172.67.174.247 to network‑level deny lists only after confirming that legitimate services are not hosted on the same address, recognizing that Cloudflare’s shared infrastructure may host unrelated traffic. The domain name itself should be added to URL filtering and email security policies to block any future attempts to reference it.

Continuous monitoring of the associated IP and ASN for new malicious domains is advised, as threat actors frequently reuse Cloudflare edge nodes. Because the domain is already flagged by VirusTotal and PhishDestroy, automated blocklist feeds will likely capture future re‑registrations, but manual rule updates provide an additional safety net. Until further forensic evidence, such as page content or credential harvesting behavior, becomes available, the recommendation is to treat post.ch‑zahlungssystem.sale as a high‑confidence phishing indicator and enforce strict deny controls across perimeter defenses.