postfinance-pay[.]info

The domain postfinance-pay.info was registered on February 21, 2026 through Web Commerce Communications Limited and is currently hosted on Cloudflare’s network (ASN 13335) with the IP address 172.67.177.246 located in the United States. DNS resolution uses the Cloudflare nameservers lady.ns.cloudflare.com and johnathan.ns.cloudflare.com. The site presents a TLS certificate identified as WE1, indicating that encrypted HTTPS connections are available, but the service has been taken offline as of the report date, July 24, 2026. Malware and URL‑reputation services have flagged the domain: 13 of 93 VirusTotal scanners marked it as malicious, and it appears on one external security blocklist.

PhishDestroy has also blocked the domain, confirming its association with phishing‑related activity. AlienVault OTX references include the domain in 13 distinct threat‑intel pulses, reinforcing the observation that it is part of a broader phishing infrastructure. No public page title, brand target, or specific scam kit information is available, so the exact impersonated entity cannot be verified at this time.

The combination of registrar data, Cloudflare hosting, TLS presence, and multiple independent detections suggests a deliberately crafted malicious site that was likely used to harvest credentials or payment information before being seized or shut down. Defenders should continue to monitor the IP address 172.67.177.246 and associated Cloudflare nameservers for any re‑use, update intrusion detection signatures with the observed domain pattern, and enforce blocklist rules that include postfinance-pay.info. Organizations using email or web filtering should ensure that the domain is denied at the perimeter, and incident response teams should treat any residual traffic to this host as potentially compromised.