chaingpt[.]beefyhubs[.]xyz

Analysis of chaingpt.beefyhubs.xyz shows a recent domain created on October 22, 2025 and hosted on the IP address 142.250.186.68, which resolves to an Autonomous System (AS15169) owned by Google LLC in Germany. The domain is registered through Dynadot LLC and uses Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No SSL certificate is presented, indicating the site was served over plain HTTP or that TLS was not configured before the domain was taken offline. The page title returned by the origin server is "Google," matching the declared brand target of Google and confirming the campaign’s intent to impersonate that brand. A Gridinsoft trust score of 0 out of 100 reflects a complete lack of trustworthiness.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal reports that 12 of 95 scanned security vendors flagged the domain, providing modest corroboration of malicious behavior. The threat is classified as brand impersonation, and the evidence suggests an attempt to lure victims by exploiting the Google brand. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms because the site is currently offline and no further page content has been captured.

Defenders should continue to monitor the IP address 142.250.186.68 for any resurgence of activity, enforce blocklists that include this domain, and consider adding the domain to internal deny lists. Network sensors should alert on DNS queries for chaingpt.beefyhubs.xyz, and any future HTTP requests to the associated IP should be inspected for anomalous traffic patterns. Because the domain lacks TLS, any attempted communication would be unencrypted, simplifying detection. Continued verification with threat‑intel platforms is recommended to capture any new indicators should the infrastructure be re‑used.