chemservice[.]net

This domain, chemservice.net, is identified as a phishing site specifically designed to impersonate ChemService, a legitimate chemical supplier. The threat type is classified as generic_phishing, targeting users with a fraudulent verification page to harvest login credentials or sensitive corporate information. As of the latest analysis, the domain has been taken offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was registered on March 11, 2026, through Ultahost, Inc., and resolves to the IP address 159.100.17.57. It is flagged by 4 of 95 security vendors on VirusTotal, indicating detection by a minority but notable portion of the security community. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Trust scores further confirm its malicious nature, with Gridinsoft assigning a 0/100 trust rating and Scamadviser providing a low score of 46/100. The site employed Nginx as its web server and enforced HSTS, while its SSL certificate was issued by Let’s Encrypt, a common but not inherently malicious certificate authority. Given its current offline status, immediate interaction risks are mitigated; however, organizations should remain vigilant for residual exposure. Historical logs should be reviewed for connections to 159.100.17.57 or the domain itself, particularly in environments where ChemService is a known vendor. Users who may have engaged with the site should reset credentials and monitor for unauthorized access. Security teams are advised to update blocklists to include this domain and its associated IP, while also investigating the registration pattern for potential related threats.