chhaisse[.]com

The domain chhaisse.com was registered through Sav.com, LLC on August 03, 2025. It is hosted on an OVH SAS infrastructure (AS16276) and resolves to the IPv4 address 15.204.206.213, which geolocates to the United States. The authoritative nameservers are ns1.serverhostgroup.com and ns2.serverhostgroup.com. No TLS certificate is presented, and the site returns HTTP 200 for the root path. Multiple security vendors have flagged the domain, with 11 out of 95 scanners reporting malicious behavior. The domain appears on at least one public security blocklist, indicating that defensive feeds have already identified it as hostile. The lack of encryption combined with a successful HTTP response suggests the operators are deliberately exposing the site to attract victims. The page title returned by the server reads "Chase | Credit Cards, Mortgages, Loans, Investing & Retirement Planning, Checking, Internet Banking & Business Banking", which aligns with a brand‑impersonation campaign targeting the Chase financial brand. The threat classification lists the target as "across", implying that the infrastructure may be reused for additional brand‑spoofing campaigns beyond Chase. Defenders should add chhaisse.com and its resolving IP address 15.204.206.213 to denylists at the network perimeter and endpoint layers. Continuous monitoring of the OVH AS16276 range for similar registration patterns is advised. Because the site lacks TLS, any inbound connections can be safely terminated without affecting legitimate traffic. Further analysis of the payload served at the URL is required to confirm the exact phishing tactics employed.