chaingpt[.]airdrpsalerts[.]xyz

On July 23, 2026, technical analysis was conducted on the domain chaingpt.airdrpsalerts.xyz, which is classified as a brand impersonation targeting Google. The domain was registered through Dynadot LLC on November 4, 2025 and is currently taken offline. DNS resolution points to the IP address 142.250.184.228, an address owned by Google LLC (AS15169) in the United States, a tactic often employed to lend perceived legitimacy to malicious sites. The domain is hosted on Cloudflare infrastructure, as indicated by the authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com.

No TLS certificate was observed; the site does not serve HTTPS traffic, which further confirms the lack of a valid SSL deployment. The page title returned by the server is simply "Google," matching the declared brand target and reinforcing the impersonation intent. Security reputation services show that 15 of 95 VirusTotal scanners flagged the domain, and it is listed on one external security blocklist. The domain was also blocked by the PhishDestroy service, and Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence of malicious behavior.

Although the site is offline and no page content was captured, the combination of a Google‑related page title, use of a Google‑owned IP address, and the presence on multiple threat intelligence feeds strongly indicates a deliberate attempt to deceive users by masquerading as a Google service. Uncertainty remains regarding the exact phishing kit or payload that may have been delivered while the site was active, as no additional artifacts such as login forms or scripts were observed. Defenders should continue to block the domain at the DNS and URL filtering layers, monitor for any re‑registration attempts, and consider adding the associated IP address to watchlists for anomalous traffic patterns that could indicate reuse in future campaigns.