post[.]purchase108[.]com

Analysis of post.purchase108.com, which was taken offline as of the report date, shows a clear infrastructure built to impersonate Chase for banking phishing. The domain resolves to IP address 178.16.53.226, hosted in the Netherlands under ASN AS202412 owned by Omegatech LTD. The IP has been flagged by 15 of 95 security vendors on VirusTotal, indicating a high likelihood of malicious activity. The domain uses the nameservers ns1.purchase108.com and ns2.purchase108.com, both of which are under the same purchase108.com namespace, suggesting a dedicated hosting environment for the campaign.

Registration details list CNOBIN INFORMATION TECHNOLOGY LIMITED as the registrar, and the domain was created on November 10 2025, a relatively recent creation date that aligns with typical phishing campaign lifecycles. No SSL certificate is present, meaning any HTTP connections would be unencrypted, a common trait of short‑lived phishing sites. The observed page title "Swiss Post" does not correspond to the targeted brand, Chase, further indicating an attempt to obscure the true intent of the site. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist, reinforcing its malicious classification.

PhishDestroy has already blocked the domain, and its current offline status reduces immediate threat, but the infrastructure components—IP address, nameservers, and registrar—remain reusable. Defenders should continue to deny traffic to 178.16.53.226, add post.purchase108.com to URL filtering policies, monitor the associated nameservers for re‑registration, and watch for any resurgence of similar domains registered through the same registrar. Indicators such as the domain name, IP, and nameserver records provide actionable data for threat hunting and blocking across network defenses.