chatgptmeta[.]app

On July 23, 2026, the domain chatgptmeta.app was observed to be hosting a brand‑impersonation campaign targeting Facebook. The site presented the HTML page title “Meta AI”, which aligns with the official naming of Facebook’s artificial‑intelligence offering, but no SSL certificate was configured, leaving the HTTP service unencrypted. DNS resolution returned the single IPv4 address 103.138.88.28, which is registered to the Vietnam Posts and Telecommunications Group (AS135905) and physically located in Vietnam. The authoritative nameservers are a.share-dns.com and b.share-dns.net, both typical of low‑cost shared DNS services. Registration records list CHILIASIA‑VN as the registrar, confirming the Vietnamese origin of the registration.

Reputation scoring from independent services is extremely low: Scamadviser assigned a trust score of 1 out of 100, and Gridinsoft reported 0 out of 100. VirusTotal scans show that 14 of 95 antivirus and URL‑reputation engines flagged the domain as malicious, indicating a consensus among a subset of vendors that the site is associated with abuse. AlienVault OTX has referenced the domain in 17 separate threat‑intel pulses, further corroborating its use in malicious campaigns. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy sink‑hole service, which suggests that defensive communities have taken concrete steps to neutralize its traffic.

The current HTTP status is offline; the site has been taken down, and no active content is reachable at the time of analysis. However, the infrastructure components—namely the IP address, DNS hosters, and registrar—remain allocated and could be repurposed for future impersonation attempts. Defenders should continue to monitor the IP 103.138.88.28 and the associated nameservers for re‑activation, enforce blocklist entries for the domain and its resolved address, and consider adding the domain to corporate URL filtering policies.