chatgpt-codex-lm[.]gitlab[.]io

This domain is flagged as a high-risk phishing site specializing in fake AI service impersonation. Analysis indicates the threat actor is attempting to deceive users into believing they are interacting with a legitimate AI coding assistant or language model interface, likely to harvest credentials or distribute malicious payloads under the guise of software updates or authentication prompts.

Infrastructure analysis reveals the following technical indicators: VirusTotal detection ratio of 1/95 security vendors, indicating minimal but confirmed malicious classification. The domain is hosted on GitLab Pages infrastructure, resolving to IP address 35.185.44.232. The SSL certificate is issued by GlobalSign nv-sa, providing a false sense of security while the underlying content remains fraudulent. As of the latest verification, the domain remains active and unblocked by most security platforms, increasing its potential reach.

Mitigation requires immediate action from both users and administrators. End users should avoid interacting with any login prompts, download buttons, or API key requests presented by this domain. Network administrators are advised to block the domain and its resolving IP (35.185.44.232) at the perimeter level. Security teams should monitor for credential submissions or unusual outbound connections to gitlab.io subdomains, particularly those mimicking AI service names. Given the domain's hosting on a legitimate platform, additional scrutiny of all gitlab.io subdomains for similar patterns is recommended to identify related threat infrastructure.