chatpye[.]com

PhishDestroy has identified chatpye.com as an elevated risk domain engaged in brand impersonation targeting Celer. This is not just a generic phishing site—it is a crypto drainer designed to steal cryptocurrency assets by mimicking the legitimate Celer platform. The domain was registered on June 30, 2023, through GoDaddy.com, LLC, and resolves to IP 52.23.70.185. Its SSL certificate is issued by Amazon / Amazon RSA 2048 M03, lending a false sense of legitimacy. The page title, "ChatPye — AI-native LMS for video training," is a deceptive front for the malicious activity.

VirusTotal data shows that 3 out of 95 security vendors flag this domain as malicious, and it appears on 2 security blocklists. AlienVault OTX has documented it in 1 threat intelligence pulse, confirming its involvement in broader malicious campaigns. Although the domain is currently offline, the threat remains relevant as similar sites may appear. The combination of a recently created domain, low but notable vendor detections, and specific brand targeting makes this a credible danger for Celer users.

Users who may have interacted with chatpye.com should immediately check their cryptocurrency wallets for unauthorized transactions and revoke any permissions granted to the site. Avoid entering any private keys or seed phrases on websites that claim to be Celer or related services. Always verify the official domain through Celer's verified social media or website. PhishDestroy recommends reporting any similar domains to security platforms and staying vigilant against future impersonation attempts. For real-time verification of suspicious domains, use PhishDestroy's lookup tool before engaging with any crypto-related site.