chaingpt[.]airdrpsalert[.]sbs

Analysis of chaingpt.airdrpsalert.sbs shows a domain created on October 22, 2025 and registered through Dynadort LLC. The site presents the page title "Google" and is classified as a brand‑impersonation campaign targeting Google. Technical probing indicates the domain resolves to IP address 172.217.18.4, an address owned by AS15169 Google LLC in the United States. The use of a Google‑owned IP for a malicious impersonation site suggests either abuse of legitimate infrastructure or compromised hosting. No SSL certificate was observed, meaning the site would have been served over plain HTTP, a common characteristic of low‑effort phishing setups. The domain is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, a configuration often employed to hide the true origin of malicious content.

VirusTotal recorded three detections out of ninety‑five scanned vendors, indicating that a minority of security engines have flagged the domain for malicious behavior. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing the view that it is being monitored as a phishing or impersonation vector. Gridinsoft assigns a trust score of 0 out of 100, reflecting the highest level of suspicion.

Current status is offline, preventing immediate interaction, but the historical indicators remain relevant for threat‑intel correlation. Uncertainty remains around the exact payload or credential‑ harvesting mechanism because no HTTP response body or page content has been captured. Defenders should continue to block the domain at perimeter devices, update URL filtering policies to include chaingpt.airdrpsalert.sbs, and monitor for any re‑appearance of the host on the same IP range. Additional investigation of the Cloudflare nameserver configuration may reveal other domains sharing this infrastructure.