chatgpt-codex-app[.]gitlab[.]io

Analysis of chatgpt-codex-app.gitlab.io shows a domain that was registered on March 26, 2013 and is hosted on GitLab Pages. The site resolves to the IP address 172.65.251.78, which belongs to the Google Cloud network (AS396982). An SSL certificate issued by GlobalSign (GlobalSign GCC R6 AlphaSSL CA 2025) is present, and the HTTP response is a 302 redirect that ultimately delivers a page whose title is "Just a moment...". Technical fingerprints reveal the use of Ruby, Ruby on Rails, Vue.js, and integrations with Apple iCloud Mail, Salesforce, Stripe, and Zendesk, indicating a typical web‑application stack rather than a static phishing landing page. VirusTotal scans report that 2 of 91 security vendors flagged the domain, and independent scoring services assign a trust score of 0 out of 100. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy, confirming that at least some security providers consider it malicious. While the exact phishing payload or credential‑harvesting page has not been captured, the combination of a deceptive page title, a redirect chain, and the presence on blocklists aligns with the generic_phishing classification. Defenders should continue to block the domain at network perimeter devices, monitor DNS queries for the associated IP, and consider adding the domain to endpoint allow‑list exclusions only after thorough verification. Further investigation of the redirect target and any form submissions would be required to determine the full scope of the campaign.