chaingpt[.]airdrpsalerts[.]lat

This domain, chaingpt.airdrpsalerts.lat, was observed to resolve to the IPv4 address 142.250.184.228, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. The domain registration record shows it was created on 29 October 2025 and is serviced by Dynadot LLC. Authoritative name servers listed are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare’s DNS infrastructure. No TLS certificate was presented during connection attempts, meaning the site would be served only over HTTP, which reduces confidentiality but also signals a lack of investment in legitimate security controls. The page title returned from the HTTP response is “Google”, matching the declared brand target and confirming the intent to impersonate the Google brand.

Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence rating. VirusTotal analysis shows that 7 of 95 scanned security vendors flagged the domain as malicious, and the domain is listed on a single external blocklist. It has also been added to the PhishDestroy blocklist. The site was taken offline before the time of reporting, and no active SSL certificate or live HTTP content could be captured for deeper content analysis.

The available evidence therefore points to a brand‑impersonation campaign that leverages a legitimate‑looking IP address and Cloudflare DNS to increase perceived trustworthiness while avoiding encryption. Defenders should continue to block the domain at network perimeter devices, update URL filtering feeds with the domain name, and monitor for any related sub‑domains that may be created under the same registrar or name‑server configuration. Additional investigation of the hosting IP for other malicious artifacts and correlation with other domains created around the same time may reveal broader infrastructure used by the threat actor.