acs-ch[.]info

The domain acs-ch.info has been identified as a credential harvesting phishing site targeting users of the American Chemical Society (ACS) portal. Analysis indicates this domain is currently offline but was previously active in collecting login credentials under the guise of legitimate ACS services. The specific threat type is classified as a generic phishing campaign with an elevated risk level due to its targeted impersonation of a scientific organization’s authentication portal. Infrastructure analysis reveals the domain was registered on December 29, 2025, through Hosting Concepts B.V. d/b/a Registrar.eu. It resolved to the IP address 158.94.209.90, geolocated in the Netherlands under AS202412 (Omegatech LTD). Detection metrics show the domain was flagged by 19 of 95 security vendors on VirusTotal, while appearing on one security blocklist. Notably, the domain lacked an SSL certificate, increasing its detectability as malicious infrastructure. The page title mirrored the domain name, a common tactic to evade initial suspicion during automated scans. At present, acs-ch.info has been taken offline, likely due to enforcement actions by security providers such as PhishDestroy. However, the infrastructure’s recent creation and rapid detection suggest potential for reemergence under similar domains. Organizations are advised to proactively monitor for domains impersonating ACS or related scientific portals, particularly those registered through Registrar.eu or resolving to the 158.94.209.0/24 range. Network defenders should implement real-time blocklisting of the IP 158.94.209.90 and conduct retrospective log analysis for connections to this address. End-users should verify domain authenticity via official ACS communication channels before entering credentials.