chain-gptssd[.]webflow[.]io

On July 24, 2026, chain-gptssd.webflow.io was identified as a high‑risk crypto‑scam infrastructure. The domain resolves to the Cloudflare‑owned address 172.64.151.8, located in the United States under ASN 13335. Its authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The site presented the page title “ChainGPT Blockchain – GitHub: Let’s build from here,” and employed Cloudflare and HTTP/3 as detected technologies. An SSL certificate issued by Google Trust Services (WE1) was observed, confirming the presence of a valid TLS layer.

The domain was created on May 08 2013 and is registered through MarkMonitor, Inc., a registrar commonly associated with brand‑protected domains. HTTP requests now return a 404 status, and the domain has been taken offline. Threat intelligence feeds have classified the site as a crypto scam, and Google Safe Browsing flags it for social engineering. VirusTotal analysis recorded 13 positive detections out of 95 scanned engines, and the domain appears on at least one security blocklist. PhishDestroy has also blocked the host.

While the exact malicious payload or credential‑harvesting page has not been captured, the combination of a misleading GitHub‑related title, a reputable SSL certificate, and Cloudflare‑provided infrastructure strongly suggests an attempt to lure cryptocurrency‑interested victims. The presence of multiple vendor detections and blocklist entries corroborates the malicious intent. Defenders should block resolution of 172.64.151.8 for this host, add chain‑gptssd.webflow.io to URL filtering and safe‑browse lists, and monitor for any future re‑registration or similar domains using the same naming pattern. Continuous observation of Cloudflare‑hosted IP ranges for suspicious activity is recommended, and any inbound traffic from this host should be logged and investigated.