chaingpt[.]beefyhubs[.]bond

This domain, chaingpt.beefyhubs.bond, was registered through Dynadot LLC on 26 October 2025. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS. DNS resolution points to IP address 142.250.181.228, which belongs to AS15169 Google LLC and is geolocated in the United States. Despite the IP belonging to Google’s infrastructure, the domain hosts no TLS certificate, leaving the HTTP service unencrypted.

The page title returned by the HTTP response is Google, matching the declared brand target of Google and the scam type of brand impersonation. The domain appears on a single security blocklist and has been flagged by PhishDestroy, which has taken the site offline. A Gridinsoft trust score of 0 out of 100 further indicates a malicious reputation. VirusTotal analysis shows that four of ninety‑five security vendors flagged the domain, confirming detection by multiple independent scanners.

The lack of a valid SSL certificate, the absence of legitimate content, and the presence on a blocklist collectively suggest that the site is being used for credential‑stealing or other fraudulent activity targeting Google users. Uncertainty remains regarding the exact payload delivered to visitors, as no additional behavioral analysis or sandbox reports are available. Defenders should continue to block the domain at the network perimeter, update DNS blocklists with the observed nameservers, and monitor for any future re‑registration attempts. Users should be warned that any request to this domain is likely malicious, and legitimate Google services will never use this sub‑domain structure or present an unsecured HTTP endpoint.