chat-gpt-next-web-six-phi-42[.]vercel[.]app

This domain is flagged as an active phishing site impersonating the ChatGPT web interface to harvest user credentials. Analysis indicates the threat type is a fake login portal, designed to mimic legitimate authentication flows to capture usernames, passwords, and potentially session tokens. The domain presents itself under the title 'ChatGPT Next Web,' a clear attempt to leverage brand recognition and deceive users into entering sensitive information. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on February 21, 2026, and currently resolves to IP 64.29.17.131, hosted on Amazon.com, Inc. (AS16509) infrastructure. The SSL certificate is issued by Google Trust Services (WR1), adding a superficial layer of legitimacy. Despite its active status, the domain appears on only one security blocklist (PhishDestroy) and has zero detections out of 95 engines on VirusTotal, suggesting it may be newly deployed or evading detection through obfuscation techniques. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP (64.29.17.131) at the network perimeter. Organizations should deploy browser-based warnings for users attempting to access the domain, particularly in environments where ChatGPT or similar AI tools are in use. Endpoint protection should be updated to flag the domain title 'ChatGPT Next Web' as a phishing indicator. Users who may have interacted with the site should be instructed to reset credentials for any services accessed during the suspected compromise window, with priority given to accounts sharing passwords with the fake portal. Monitoring for anomalous authentication attempts or unauthorized access linked to this domain is recommended for at least 30 days post-exposure.