chaingpt[.]beefy-hub[.]sbs

This domain, chaingpt.beefy-hub.sbs, was registered through Dynadot LLC on 25 October 2025 and is currently taken offline. Infrastructure analysis shows it resolves to 142.250.181.228, an address owned by AS15169 Google LLC in the United States. The domain uses Cloudflare name servers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no TLS certificate was observed, indicating the site was served without encryption. The page title returned by the HTTP response is “Google”, matching the declared brand target of Google and confirming the impersonation intent.

Google Safe Browsing has labeled the URL as a social‑engineering threat, and the domain appears on one public blocklist maintained by PhishDestroy. VirusTotal scanned the host and eight of ninety‑five AV engines reported a detection, reinforcing the malicious classification. Gridinsoft assigned a trust score of zero out of one hundred, reflecting extreme risk. The limited public exposure—only a single blocklist entry and a modest number of AV detections—suggests the campaign was short‑lived or rapidly mitigated.

However, the use of a legitimate Google IP range may have been intended to bypass network‑level filters that rely on destination IP reputation. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same second‑level or sub‑domain pattern, and enforce strict TLS inspection to detect future attempts that may leverage similar infrastructure. Additional watch on the associated Cloudflare name servers is advised, as they could be reused for other impersonation campaigns. Ongoing threat‑intel feeds should be queried for new sightings of chaingpt.beefy‑hub.sbs or related aliases.