postfinance[.]club

This domain, postfinance.club, operates as a credential harvesting platform targeting users of a legitimate financial service. Analysis indicates the site mimics a banking login portal to collect usernames, passwords, and potentially multi-factor authentication codes. The infrastructure is designed to deceive victims into entering sensitive account details under the false pretense of account verification or security updates, a common tactic in financial phishing campaigns. Infrastructure analysis reveals multiple red flags. The domain was registered on March 04, 2026, through Global Domain Group LLC, an unusually future-dated creation that may indicate bulk registration for malicious purposes. It resolves to IP address 104.21.65.178, hosted on Cloudflare's network (AS13335), which is frequently abused to mask attacker infrastructure. Security vendors have flagged the domain as malicious, with 19 out of 95 engines on VirusTotal detecting it as phishing. Additionally, it appears on one security blocklist and is explicitly labeled as phishing by Google Safe Browsing. Users who accessed postfinance.club should immediately take corrective action. Change all passwords associated with financial accounts, particularly if credentials were entered on the site. Enable multi-factor authentication if not already active, using app-based or hardware tokens rather than SMS. Monitor financial statements for unauthorized transactions and report any suspicious activity to the affected institution. If personal or financial data was submitted, consider placing a fraud alert with credit bureaus. The domain is currently offline, but similar threats may emerge using comparable infrastructure or naming conventions.