post[.]purchase105[.]com

Analysis of post.purchase105.com indicates that the domain was created on November 10, 2025 and is currently taken offline. The site was registered through CNOBIN INFORMATION TECHNOLOGY LIMITED and resolves to the IPv4 address 178.16.53.226, which is associated with AS202412 Omegatech LTD in the Netherlands. No TLS certificate was observed for the domain, suggesting that traffic would be unencrypted if the site were active. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal records show that 15 of 95 scanned security vendors flagged the domain, providing independent confirmation of its suspicious nature. The page title returned by the server is "Swiss Post," while the branding target is identified as Chase, indicating a brand‑impersonation campaign aimed at banking credentials. Nameservers ns1.purchase105.com and ns2.purchase105.com are delegated to the same domain, a pattern commonly observed in phishing infrastructure.

The combination of a low trust score, multiple vendor detections, lack of SSL, and the explicit block by PhishDestroy suggests that the domain was used for a banking phishing operation. Defenders should ensure that any references to post.purchase105.com are blocked at the DNS and proxy layers, monitor for residual activity targeting Chase customers, and consider adding the domain to internal blocklists. Continuous observation of the hosting ASN and registrar may reveal additional related domains, and threat‑intel sharing with peers is recommended to improve detection coverage.