chaingpt[.]portal-hubs[.]cfd

The domain chaingpt.portal-hubs.cfd is a confirmed phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google service to deceive users into entering sensitive information, constituting a credential phishing threat. No crypto drainer kit was identified. As of the latest verification, chaingpt.portal-hubs.cfd has been taken offline, though prior activity remains a risk for those who interacted with it.

Technical indicators confirm the malicious nature of chaingpt.portal-hubs.cfd. The domain was flagged by 2 of 95 security vendors on VirusTotal, including ChainPatrol and SOCRadar, and appears on 1 security blocklist (PhishDestroy). Registered through Dynadot LLC on October 21, 2025, it resolved to the IP address 216.58.206.68, hosted under AS15169 (Google LLC) in Germany. No SSL certificate was issued, and the observed page title was 'Google'. Nameservers were brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Gridinsoft assigned a trust score of 0/100, further indicating its fraudulent intent.

Users who visited chaingpt.portal-hubs.cfd should immediately change any passwords entered on the site, especially for Google accounts, and enable two-factor authentication (2FA) where available. Monitor financial and online accounts for unauthorized activity. Report the domain to Google’s phishing reporting tool at https://safebrowsing.google.com/report_phish/ and to the registrar, Dynadot LLC, via abuse@dynadot.com. If credentials were shared, consider notifying relevant financial institutions to prevent fraud.