finbro[.]chaserich[.]com

Analysis of finbro.chaserich.com shows a confirmed banking phishing infrastructure that impersonates Chase. The domain was registered through DreamHost on July 19, 2022 and resolves to the IPv4 address 66.33.22.31, which is assigned to AS400940 Railway in the United States. The hosting provider for the name server pair lars.ns.cloudflare.com and pat.ns.cloudflare.com is Cloudflare, indicating the attacker leveraged a reputable DNS service to obscure the true origin of the web server. The site presented the page title "FinBro Terminal," a label that aligns with the observed scam type of banking phishing, but the page content has not been publicly captured.

The TLS certificate is issued by Let’s Encrypt (R13), confirming that HTTPS was enabled at the time of observation. The domain appears on a single security blocklist and has been flagged by PhishDestroy as a malicious entry. VirusTotal scanning shows that 2 of 95 security vendors identified the domain as malicious, providing independent corroboration of its threat status. Current monitoring indicates the domain is taken offline, which may be a temporary takedown or a shift in the attacker’s infrastructure.

Uncertainty remains regarding the specific phishing kit used, the presence of any credential‑harvesting forms, and whether additional domains share the same IP address or certificate. Defenders should block finbro.chaserich.com at the DNS and proxy layers, add the IP 66.33.22.31 to network‑level deny lists, and monitor for any new subdomains under the same registrar or nameserver configuration. Ongoing intelligence collection should focus on correlating future sightings of the AS400940 prefix with other known phishing campaigns targeting Chase customers, and on obtaining a live snapshot of the site if it resurfaces, to enrich detection signatures.