chase998[.]club

The domain chase998.club is currently active and engaged in brand impersonation phishing targeting customers of Chase Bank. Analysis indicates the site presents a fraudulent login interface under the page title 'Ana Sayfa,' designed to harvest credentials from unsuspecting victims. The threat type is classified as high-risk due to its direct targeting of financial institution customers and active status. Infrastructure analysis reveals the domain was registered on November 18, 2025, through Domain International Services Limited, a registrar frequently associated with malicious domains. It resolves to the IPv6 address 2606:4700:3032::6815:1135, hosted on infrastructure belonging to AS13335 (Cloudflare, Inc.) in the United States. The domain lacks an SSL certificate, increasing the risk of interception during credential transmission. Detection metrics show the domain is flagged by 15 of 95 security vendors on VirusTotal and appears on one security blocklist. Google Safe Browsing has also classified the domain as phishing, corroborating the malicious intent. Current status remains active, posing an ongoing threat to users. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include chase998.club. Financial institutions should alert customers to avoid interacting with the site and report any credentials entered on the domain as compromised. Monitoring for related domains registered through the same registrar or resolving to the same IP infrastructure is recommended to identify potential follow-up campaigns.