chaingpt[.]airdrpalerts[.]cfd

This domain, chaingpt.airdrpalerts.cfd, is flagged as a brand impersonation threat targeting Google, with elevated risk indicators. Registered on October 25, 2025, through Dynadot LLC, the domain lacks an SSL certificate and resolves to the IP address 142.250.185.228, which is associated with AS15169 (Google LLC) in the US. Infrastructure analysis reveals Cloudflare nameservers (brenna.ns.cloudflare.com and hassan.ns.cloudflare.com), a common configuration for both legitimate and malicious domains. The page title, 'Google,' aligns with the reported brand impersonation scam type, though the exact content and functionality of the site remain unanalyzed.

Detection data is limited but indicative of malicious intent. Two of 95 security vendors on VirusTotal flagged the domain, and it appears on one security blocklist, with PhishDestroy actively blocking it. The Gridinsoft trust score of 0/100 further supports its classification as high-risk. The domain is currently offline, which may limit further analysis or immediate threat activity.

Defenders should treat this domain as confirmed malicious for Google brand impersonation, particularly in contexts where users may expect Google-related services or login pages. No evidence of a phishing kit or additional scam categorization (e.g., crypto, investment) is present in the available data. Recommended actions include blocking the domain at the DNS or proxy level, monitoring for re-registration or IP changes, and reviewing logs for prior connections from internal networks. Given the lack of SSL and the use of Cloudflare, defenders may also investigate associated certificates or subdomains for related threats.