chaingpt[.]beefy-hub[.]lol

This domain, chaingpt.beefy-hub.lol, was registered on 25 October 2025 through Dynadot LLC. The zone is hosted on Cloudflare name servers (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com) and resolves to the IP address 142.250.185.132, which is owned by Google LLC (AS15169) and located in the United States. The lack of an SSL certificate indicates the site was served over plain HTTP when it was active. The page title returned by the server is simply “Google”, matching the declared brand target of Google and confirming the intent to impersonate that brand. VirusTotal records show that ten out of ninety‑five scanning engines flagged the domain, and Google Safe Browsing has listed it as a social‑engineering threat. The domain also appears on a single external blocklist and has been added to the PhishDestroy blocklist.

Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The site is currently offline, and no further content has been captured. Analysis indicates that the infrastructure was deliberately chosen to increase credibility: the IP belongs to Google’s own network, which can deceive automated reputation checks, while the use of Cloudflare DNS provides resilience and obscures the true hosting environment. The combination of brand‑specific page title, the Google Safe Browsing flag, and multiple vendor detections suggests a classic brand‑impersonation campaign aimed at harvesting credentials or delivering malicious payloads.

Defenders should continue to block the domain at perimeter filters and update any URL or domain reputation feeds with the full hostname. Security teams should monitor for any future re‑registration of the sub‑domain or similar patterns that resolve to Google‑owned IP ranges. Incident response playbooks for credential‑theft should be triggered if users report unexpected prompts for Google authentication originating from this domain.