OpenAI
Certificate findings for OpenAI
DomainSpoof matched these hostnames, from public certificate logs, to OpenAI's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.
Published now · 58 findings, grouped by hostname
- www.openai888.site CN · AS24429 · Zhejiang Taobao Network Co.…Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 47 d ago
DetailsHide details for www.openai888.site
- Hostname
- www.openai888.site
- First seen
- 2026-11-05 10:16 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 47.246.22.248.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 47.246.22.248
- Certificate
- Issued by YR2 · precertificateValid 2026-11-05 09:15 UTC to 2027-02-03 09:15 UTCLogged 2026-11-05 10:13 UTC in Let's Encrypt Sycamore2027h1, entry 957,476,634SHA-256 5ed466554e2e6cdf1e0ca87b38250e20f8875443f07aadd846850988f322ce45Public key SHA-256 2e2708c9aea59f05b45d6088722cc01df8f794cf36793f8af1e8b784564e9837
- Brand
- OpenAI
- Addresses
- 47.246.22.248 · China · AS24429 Taobao - Zhejiang Taobao Network Co.,Ltd
- Domain
- openai888.site
- Registered
- 2026-09-19 · DNSPod, Inc.
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 10:58 UTC
- openai.uk CY · AS47583 · AS-HOSTINGER Hostinger Inte…Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 7 y ago
DetailsHide details for openai.uk
- Hostname
- openai.uk
- First seen
- 2026-11-05 08:39 UTC
- First published
- 2026-11-05 09:50 UTC
- DNS
- Resolves · checked 2026-11-05 09:57 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.108.98.138.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 91.108.98.138
- Certificate
- Issued by YE2Valid 2026-11-05 07:30 UTC to 2027-02-03 07:30 UTCLogged 2026-11-05 08:29 UTC in Google PlumbersArms2027h1, entry 623,019,010SHA-256 4682509ff930c005b2a3817a397e338fc14f64a069c4b3d6165e7294baace36aPublic key SHA-256 63c4c97e23ae091f00cdd94e2abd7ef67a344fd6a6a22bc3b150f563eaaaf33c
- Brand
- OpenAI
- Addresses
- 91.108.98.138 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
- Hostinger
- Hostinger (91.108.98.138): shared web hosting and domain registration. One address typically serves many customer sites.
- Domain
- openai.uk
- Registered
- 2019-07-02 · Namecheap, Inc.
- MX
- Receives mail at mx1.hostinger.com, mx2.hostinger.com
- SPF
- SPF record with ~all: other senders soft-fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:43 UTC
- chatgpt123.cloud CY · AS47583 · AS-HOSTINGER Hostinger Inte…Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 11 mo ago
DetailsHide details for chatgpt123.cloud
- Hostname
- chatgpt123.cloud
- First seen
- 2026-11-05 08:12 UTC
- First published
- 2026-11-05 08:42 UTC
- DNS
- Resolves · checked 2026-11-05 08:45 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 2.57.91.91
- Latest DNS check
- Certificate
- Issued by YE2 · precertificateValid 2026-11-05 07:03 UTC to 2027-02-03 07:03 UTCLogged 2026-11-05 08:02 UTC in Let's Encrypt Sycamore2027h1, entry 955,687,976SHA-256 2392384b3b78c08e36b983e3106fe38a62fd83eb7308493fb3bfb261ae9e3253Public key SHA-256 03db591b5477da88ab225ad3b884ac3ec780e3e9c7edbafbb7819f60f40cd85f
- Brand
- OpenAI
- Addresses
- 2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
- Hostinger
- Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
- Domain
- chatgpt123.cloud
- Registered
- 2025-12-08 · HOSTINGER operations, UAB
- MX
- Receives mail at mail.chatgpt123.cloud
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:06 UTC
- www.chatgpt123.cloud CY · AS47583 · AS-HOSTINGER Hostinger Inte…Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 11 mo ago
DetailsHide details for www.chatgpt123.cloud
- Hostname
- www.chatgpt123.cloud
- First seen
- 2026-11-05 08:05 UTC
- First published
- 2026-11-05 08:42 UTC
- DNS
- Resolves · checked 2026-11-05 08:45 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 2.57.91.91
- Latest DNS check
- Certificate
- Issued by YE2 · precertificateValid 2026-11-05 07:03 UTC to 2027-02-03 07:03 UTCLogged 2026-11-05 08:02 UTC in Let's Encrypt Sycamore2027h1, entry 955,687,976SHA-256 2392384b3b78c08e36b983e3106fe38a62fd83eb7308493fb3bfb261ae9e3253Public key SHA-256 03db591b5477da88ab225ad3b884ac3ec780e3e9c7edbafbb7819f60f40cd85f
- Brand
- OpenAI
- Addresses
- 2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
- Hostinger
- Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
- Domain
- chatgpt123.cloud
- Registered
- 2025-12-08 · HOSTINGER operations, UAB
- MX
- Receives mail at mail.chatgpt123.cloud
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:06 UTC
- chatgpt.menu FR · AS16276 · OVH OVH SASPhishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 4 y ago
DetailsHide details for chatgpt.menu
- Hostname
- chatgpt.menu
- First seen
- 2026-11-05 00:01 UTC
- First published
- 2026-11-05 00:41 UTC
- DNS
- Resolves · checked 2026-11-05 00:49 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.91.236.255.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 51.91.236.255
- Latest DNS check
- Certificate
- Issued by YE1 · precertificateValid 2026-11-04 23:01 UTC to 2027-02-02 23:01 UTCLogged 2026-11-04 23:59 UTC in IPng Networks Halloumi2027h1, entry 367,246,401SHA-256 534550e3eb6d766917e032ecffff3e30e4e19708e69f2a5e45e6e1b3ce9638eePublic key SHA-256 c7ca13d11b25be7957a3ff7aab2609aa6b7a97f93e431db20c8e7e5e1f980700
- Brand
- OpenAI
- Addresses
- 51.91.236.255 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
- OVH
- OVH (51.91.236.255): a cloud provider. It rents servers and addresses to its customers.
- Domain
- chatgpt.menu
- Registered
- 2023-01-02 · OVH sas
- MX
- Receives mail at mx1.mail.ovh.net, mx2.mail.ovh.net, mx3.mail.ovh.net
- SPF
- SPF record with ~all: other senders soft-fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 09:50 UTC
- www.ma-formation-chatgpt.fr FR · AS16276 · OVH OVH SASPhishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 1 d ago
DetailsHide details for www.ma-formation-chatgpt.fr
- Hostname
- www.ma-formation-chatgpt.fr
- First seen
- 2026-11-04 23:58 UTC
- First published
- 2026-11-05 00:41 UTC
- DNS
- Resolves · checked 2026-11-05 00:49 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 145.239.37.162.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 145.239.37.162
- Latest DNS check
- Certificate
- Issued by YE2 · precertificateValid 2026-11-04 22:55 UTC to 2027-02-02 22:55 UTCLogged 2026-11-04 23:54 UTC in DigiCert Wyvern2027h1, entry 408,793,129SHA-256 0151caa3d76c95fc0bf4d7eb1f31b69ed1ca3d802bf3158edfeb864b64cb0637Public key SHA-256 3d6a86073687feb2805d117811ad1f8e20504dd2b67dcf64748c9f22bbd0d320
- Brand
- OpenAI
- Addresses
- 145.239.37.162 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
- OVH
- OVH (145.239.37.162): a cloud provider. It rents servers and addresses to its customers.
- Domain
- ma-formation-chatgpt.fr
- Registered
- 2026-11-04 · OVH
- MX
- Receives mail at mx1.mail.ovh.net, mx2.mail.ovh.net, mx3.mail.ovh.net
- SPF
- SPF record with -all: other senders fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 00:41 UTC
- ma-formation-chatgpt.fr FR · AS16276 · OVH OVH SASPhishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 1 d ago
DetailsHide details for ma-formation-chatgpt.fr
- Hostname
- ma-formation-chatgpt.fr
- First seen
- 2026-11-04 23:58 UTC
- First published
- 2026-11-05 00:41 UTC
- DNS
- Resolves · checked 2026-11-05 00:49 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 145.239.37.162.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 145.239.37.162
- Latest DNS check
- Certificate
- Issued by YE2 · precertificateValid 2026-11-04 22:55 UTC to 2027-02-02 22:55 UTCLogged 2026-11-04 23:54 UTC in Geomys Tuscolo2027h1, entry 479,424,890SHA-256 f6ee80161bbabe6c39c61346e0be86d08fcda6c6862e5d04d247d1f02906606cPublic key SHA-256 177895a589acaf1cf3f7c4bc428af524bedfc9240e6e08374dd2294132af700a
- Brand
- OpenAI
- Addresses
- 145.239.37.162 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
- OVH
- OVH (145.239.37.162): a cloud provider. It rents servers and addresses to its customers.
- Domain
- ma-formation-chatgpt.fr
- Registered
- 2026-11-04 · OVH
- MX
- Receives mail at mx1.mail.ovh.net, mx2.mail.ovh.net, mx3.mail.ovh.net
- SPF
- SPF record with -all: other senders fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 00:41 UTC
- www.chatgpt.college FR · AS16276 · OVH OVH SASPhishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 4 y ago
DetailsHide details for www.chatgpt.college
- Hostname
- www.chatgpt.college
- First seen
- 2026-11-04 17:21 UTC
- First published
- 2026-11-04 18:05 UTC
- DNS
- Resolves · checked 2026-11-04 18:17 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.91.236.255.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 51.91.236.255
- Latest DNS check
- Certificate
- Issued by YE2Valid 2026-11-04 16:19 UTC to 2027-02-02 16:19 UTCLogged 2026-11-04 17:17 UTC in Google ParcelYard2027h1, entry 611,845,057SHA-256 ea45a9bd61161e2bad14d7c41aa6a6a07c6a4409bb2c9196f12a2793480ec2f6Public key SHA-256 7832c2c5ce3fc83ee7163e3547659f93a8c960f62a1495c6f85c4ed3c12be3c0
- Brand
- OpenAI
- Addresses
- 51.91.236.255 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
- OVH
- OVH (51.91.236.255): a cloud provider. It rents servers and addresses to its customers.
- Domain
- chatgpt.college
- Registered
- 2023-01-02 · OVH sas
- MX
- Receives mail at mx1.mail.ovh.net, mx2.mail.ovh.net, mx3.mail.ovh.net
- SPF
- SPF record with ~all: other senders soft-fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:12 UTC
- www.chatgpt.menu FR · AS16276 · OVH OVH SASPhishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 4 y ago
DetailsHide details for www.chatgpt.menu
- Hostname
- www.chatgpt.menu
- First seen
- 2026-11-04 09:47 UTC
- First published
- 2026-11-04 10:38 UTC
- DNS
- Resolves · checked 2026-11-05 10:49 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.91.236.255.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 51.91.236.255
- Latest DNS check
- Certificate
- Issued by YE2 · precertificateValid 2026-11-04 08:45 UTC to 2027-02-02 08:45 UTCLogged 2026-11-04 09:43 UTC in Let's Encrypt Willow2027h1, entry 930,004,628SHA-256 1b3395c5498e34c6b81d0f5054545e2e45d4f78084215125aea16944c611f9dbPublic key SHA-256 1504f2f8e6d78ce687bd5f08598294754070a77400b6e82f88a184bab40223a9
- Brand
- OpenAI
- Addresses
- 51.91.236.255 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
- OVH
- OVH (51.91.236.255): a cloud provider. It rents servers and addresses to its customers.
- Domain
- chatgpt.menu
- Registered
- 2023-01-02 · OVH sas
- MX
- Receives mail at mx1.mail.ovh.net, mx2.mail.ovh.net, mx3.mail.ovh.net
- SPF
- SPF record with ~all: other senders soft-fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 09:50 UTC
- chatgpt.doctor FR · AS16276 · OVH OVH SASPhishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 4 y ago
DetailsHide details for chatgpt.doctor
- Hostname
- chatgpt.doctor
- First seen
- 2026-11-04 08:46 UTC
- First published
- 2026-11-04 09:19 UTC
- DNS
- Resolves · checked 2026-11-05 09:38 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.91.236.255.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 51.91.236.255
- Latest DNS check
- Certificate
- Issued by YE1 · precertificateValid 2026-11-04 07:46 UTC to 2027-02-02 07:46 UTCLogged 2026-11-04 08:44 UTC in DigiCert Sphinx2027h1, entry 352,907,667SHA-256 0da026c445e1e92a4e4095be03cb6ade85f70dd8b8978a228264b069d964f7a3Public key SHA-256 e06574764daaea3b949cd05c7bc6badd16835f4e5355a26ff314c24c2f72bbad
- Brand
- OpenAI
- Addresses
- 51.91.236.255 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
- OVH
- OVH (51.91.236.255): a cloud provider. It rents servers and addresses to its customers.
- Domain
- chatgpt.doctor
- Registered
- 2023-01-02 · OVH SAS
- MX
- Receives mail at mx1.mail.ovh.net, mx2.mail.ovh.net, mx3.mail.ovh.net
- SPF
- SPF record with ~all: other senders soft-fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:54 UTC
- chatgpt.college FR · AS16276 · OVH OVH SASPhishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 4 y ago
DetailsHide details for chatgpt.college
- Hostname
- chatgpt.college
- First seen
- 2026-11-04 07:56 UTC
- First published
- 2026-11-04 09:19 UTC
- DNS
- Resolves · checked 2026-11-05 09:38 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.91.236.255.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 51.91.236.255
- Latest DNS check
- Certificate
- Issued by YE1 · precertificateValid 2026-11-04 06:56 UTC to 2027-02-02 06:56 UTCLogged 2026-11-04 07:54 UTC in Geomys Tuscolo2027h1, entry 470,329,446SHA-256 64f0d0ecf46e02612393281230bb6228a4b84d3893d11e5a197bb4d24f7034ffPublic key SHA-256 64e9b566e473953b058f1e5838603efd291d9e6199d95122ecd5dd11f85d270a
- Brand
- OpenAI
- Addresses
- 51.91.236.255 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
- OVH
- OVH (51.91.236.255): a cloud provider. It rents servers and addresses to its customers.
- Domain
- chatgpt.college
- Registered
- 2023-01-02 · OVH sas
- MX
- Receives mail at mx1.mail.ovh.net, mx2.mail.ovh.net, mx3.mail.ovh.net
- SPF
- SPF record with ~all: other senders soft-fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:12 UTC
- wildcard.wildcard.mcp-chatgpt-starter.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…Phishing hostAddress hosted confirmed phishing in the last 48 h
DetailsHide details for wildcard.wildcard.mcp-chatgpt-starter.wasmer.app
- Hostname
- wildcard.wildcard.mcp-chatgpt-starter.wasmer.app
- First seen
- 2026-11-03 13:37 UTC
- First published
- 2026-11-03 14:30 UTC
- DNS
- Resolves · checked 2026-11-04 14:33 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 5.161.23.223
- Latest DNS check
- Certificate
- Issued by YE2Valid 2026-11-03 12:35 UTC to 2027-02-01 12:35 UTCLogged 2026-11-03 13:34 UTC in Google ParcelYard2027h1, entry 591,059,979SHA-256 965d1349c6c0d2bef9cd6dd884b2608da9fd37bdd8f81e78495d07061ab3777ePublic key SHA-256 2d856cb523717f6517dab7dab03e1d66a6992fd74a660bb293866bb6936aca6d
- Brand
- OpenAI
- Addresses
- 5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
- wwwchatgpt.net DE · AS24940 · HETZNER-AS Hetzner Online G…Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 4 y ago
DetailsHide details for wwwchatgpt.net
- Hostname
- wwwchatgpt.net
- First seen
- 2026-11-03 13:22 UTC
- First published
- 2026-11-03 18:16 UTC
- DNS
- Resolves · checked 2026-11-04 18:20 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.98.101.145.
- Resolved to 91.98.101.145
- Phishing-host list fetched with the address
- Latest DNS check
- Brand
- OpenAI
- Addresses
- 91.98.101.145 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
- Hetzner
- Hetzner (91.98.101.145): a cloud provider. It rents servers and addresses to its customers.
- Domain
- wwwchatgpt.net
- Registered
- 2023-01-19 · Key-Systems GmbH
- MX
- Receives mail at mx.domainparking.de
- SPF
- SPF record with -all: other senders fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 18:19 UTC
- www.wwwchatgpt.net DE · AS24940 · HETZNER-AS Hetzner Online G…Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 4 y ago
DetailsHide details for www.wwwchatgpt.net
- Hostname
- www.wwwchatgpt.net
- First seen
- 2026-11-03 13:22 UTC
- First published
- 2026-11-03 18:16 UTC
- DNS
- Resolves · checked 2026-11-04 18:20 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 91.98.101.145.
- Resolved to 91.98.101.145
- Phishing-host list fetched with the address
- Latest DNS check
- Brand
- OpenAI
- Addresses
- 91.98.101.145 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
- Hetzner
- Hetzner (91.98.101.145): a cloud provider. It rents servers and addresses to its customers.
- Domain
- wwwchatgpt.net
- Registered
- 2023-01-19 · Key-Systems GmbH
- MX
- Receives mail at mx.domainparking.de
- SPF
- SPF record with -all: other senders fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 18:19 UTC
- www.chatgpt-brief.com US · AS16509 · Amazon.com, Inc.2 addressesListedAmazon Web ServicesUnder chatgpt-brief.com, listed by USOMMX presentSPF ~allDMARC policy noneRegistered 4 mo ago
DetailsHide details for www.chatgpt-brief.com
- Hostname
- www.chatgpt-brief.com
- First seen
- 2026-11-03 07:26 UTC
- First published
- 2026-11-03 07:43 UTC
- Listing
- USOM listed it 2026-10-07 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:43 UTC
- DNS
- Resolves · checked 2026-11-05 07:49 UTC
- Listed
- USOM, listing chatgpt-brief.com and the names under it
- Listed by USOM
- Certificate logged in CT
- We matched its certificate name
- Latest DNS check
- Certificate
- Issued by YR2Valid 2026-11-03 06:25 UTC to 2027-02-01 06:25 UTCLogged 2026-11-03 07:24 UTC in Google ParcelYard2027h1, entry 585,863,109SHA-256 a20decee4a527a3f20908597257aae864f1defd57004e50eb0a83518bbd1ac29Public key SHA-256 6a3fcc1e91d47a3854ed37d45844b6ae3691883991ce2a31ae9cce08862455db
- Brand
- OpenAI
- Addresses
- 216.150.1.129 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)216.150.16.129 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
- Amazon Web Services
- Amazon Web Services (216.150.1.129, 216.150.16.129): a cloud provider. It rents servers and addresses to its customers.
- Domain
- chatgpt-brief.com
- Registered
- 2026-06-30 · Ultahost, Inc.
- MX
- Receives mail at mx1.improvmx.com, mx2.improvmx.com
- SPF
- SPF record with ~all: other senders soft-fail
- DMARC
- DMARC policy p=none: reports only
- Checked
- 2026-11-04 23:22 UTC
- www.chatgpt-lamda.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 y ago
DetailsHide details for www.chatgpt-lamda.com
- Hostname
- www.chatgpt-lamda.com
- First seen
- 2026-11-02 21:07 UTC
- First published
- 2026-11-02 22:16 UTC
- DNS
- Resolves · checked 2026-11-04 22:20 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 2.57.91.91
- Latest DNS check
- Certificate
- Issued by YE1 · precertificateValid 2026-11-02 20:04 UTC to 2027-01-31 20:04 UTCLogged 2026-11-02 21:03 UTC in Geomys Tuscolo2027h1, entry 449,986,716SHA-256 3faf8eb5c1b3941fe063bfde290ac1c26c86ed7198cd81df240a9cc1adb41d91Public key SHA-256 03f59d6b641795a71286bced763b52c5faa29526fefa568c53d4e2ffea603a99
- Brand
- OpenAI
- Addresses
- 2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
- Hostinger
- Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
- Domain
- chatgpt-lamda.com
- Registered
- 2023-01-20 · HOSTINGER operations, UAB
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 22:18 UTC
- chatgpt-lamda.com CY · AS47583 · AS-HOSTINGER Hostinger Inte…Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 y ago
DetailsHide details for chatgpt-lamda.com
- Hostname
- chatgpt-lamda.com
- First seen
- 2026-11-02 21:06 UTC
- First published
- 2026-11-02 22:16 UTC
- DNS
- Resolves · checked 2026-11-04 22:20 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 2.57.91.91
- Latest DNS check
- Certificate
- Issued by YE1 · precertificateValid 2026-11-02 20:04 UTC to 2027-01-31 20:04 UTCLogged 2026-11-02 21:03 UTC in Geomys Tuscolo2027h1, entry 449,986,716SHA-256 3faf8eb5c1b3941fe063bfde290ac1c26c86ed7198cd81df240a9cc1adb41d91Public key SHA-256 03f59d6b641795a71286bced763b52c5faa29526fefa568c53d4e2ffea603a99
- Brand
- OpenAI
- Addresses
- 2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
- Hostinger
- Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
- Domain
- chatgpt-lamda.com
- Registered
- 2023-01-20 · HOSTINGER operations, UAB
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 22:18 UTC
- www.openaimarket.co.uk US · AS20473 · The Constant Company, LLCPhishing hostVultrAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 7 mo ago
DetailsHide details for www.openaimarket.co.uk
- Hostname
- www.openaimarket.co.uk
- First seen
- 2026-11-02 18:01 UTC
- First published
- 2026-11-04 10:44 UTC
- DNS
- Resolves · checked 2026-11-05 10:49 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 64.176.195.8.
- Resolved to 64.176.195.8
- Phishing-host list fetched with the address
- Latest DNS check
- Brand
- OpenAI
- Addresses
- 64.176.195.8 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
- Vultr
- Vultr (64.176.195.8): a cloud provider. It rents servers and addresses to its customers.
- Domain
- openaimarket.co.uk
- Registered
- 2026-04-08 · Abion AB
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 09:32 UTC
- openaimarket.co.uk US · AS20473 · The Constant Company, LLCPhishing hostVultrAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 7 mo ago
DetailsHide details for openaimarket.co.uk
- Hostname
- openaimarket.co.uk
- First seen
- 2026-11-02 18:01 UTC
- First published
- 2026-11-04 10:44 UTC
- DNS
- Resolves · checked 2026-11-05 10:49 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 64.176.195.8.
- Resolved to 64.176.195.8
- Phishing-host list fetched with the address
- Latest DNS check
- Brand
- OpenAI
- Addresses
- 64.176.195.8 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
- Vultr
- Vultr (64.176.195.8): a cloud provider. It rents servers and addresses to its customers.
- Domain
- openaimarket.co.uk
- Registered
- 2026-04-08 · Abion AB
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 09:32 UTC
- www.openaihub.co.uk US · AS20473 · The Constant Company, LLCPhishing hostVultrAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 7 mo ago
DetailsHide details for www.openaihub.co.uk
- Hostname
- www.openaihub.co.uk
- First seen
- 2026-11-02 16:32 UTC
- First published
- 2026-11-04 10:44 UTC
- DNS
- Resolves · checked 2026-11-05 10:49 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 64.176.195.8.
- Resolved to 64.176.195.8
- Phishing-host list fetched with the address
- Latest DNS check
- Brand
- OpenAI
- Addresses
- 64.176.195.8 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
- Vultr
- Vultr (64.176.195.8): a cloud provider. It rents servers and addresses to its customers.
- Domain
- openaihub.co.uk
- Registered
- 2026-04-08 · Abion AB
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 09:32 UTC
- openaihub.co.uk US · AS20473 · The Constant Company, LLCPhishing hostVultrAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 7 mo ago
DetailsHide details for openaihub.co.uk
- Hostname
- openaihub.co.uk
- First seen
- 2026-11-02 16:32 UTC
- First published
- 2026-11-04 10:44 UTC
- DNS
- Resolves · checked 2026-11-05 10:49 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 64.176.195.8.
- Resolved to 64.176.195.8
- Phishing-host list fetched with the address
- Latest DNS check
- Brand
- OpenAI
- Addresses
- 64.176.195.8 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
- Vultr
- Vultr (64.176.195.8): a cloud provider. It rents servers and addresses to its customers.
- Domain
- openaihub.co.uk
- Registered
- 2026-04-08 · Abion AB
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 09:32 UTC
- openai-market.com MD · AS200019 · AlexHost ALEXHOST S.R.L.Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 3 y ago
DetailsHide details for openai-market.com
- Hostname
- openai-market.com
- First seen
- 2026-11-02 15:01 UTC
- First published
- 2026-11-02 15:44 UTC
- DNS
- Resolves · checked 2026-11-04 15:58 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 176.123.0.199.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 176.123.0.199
- Latest DNS check
- Certificate
- Issued by YR2Valid 2026-11-02 14:01 UTC to 2027-01-31 14:01 UTCLogged 2026-11-02 14:59 UTC in Let's Encrypt Sycamore2027h1, entry 905,603,738SHA-256 57382a6ec2e025fdf2a6fc82d01298a596ee5875392de8ddf98188aa1253043ePublic key SHA-256 634c23f35bac443f5a6e994c678510bac75860172c16fa44e0f3f68dd458079d
- Brand
- OpenAI
- Addresses
- 176.123.0.199 · Moldova · AS200019 AlexHost ALEXHOST S.R.L.
- Domain
- openai-market.com
- Registered
- 2023-07-19 · CSL Computer Service Langenbach GmbH d/b/a joker.com
- MX
- Receives mail at openai-market.com
- SPF
- SPF record with ~all: other senders soft-fail
- DMARC
- DMARC policy p=none: reports only
- Checked
- 2026-11-04 16:53 UTC
- www.chatgptsite.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 3 d ago
DetailsHide details for www.chatgptsite.pl
- Hostname
- www.chatgptsite.pl
- First seen
- 2026-11-02 14:47 UTC
- First published
- 2026-11-02 15:44 UTC
- DNS
- Resolves · checked 2026-11-04 15:58 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 185.253.212.22
- Latest DNS check
- Certificate
- Issued by YR1Valid 2026-11-02 13:43 UTC to 2027-01-31 13:43 UTCLogged 2026-11-02 14:42 UTC in Let's Encrypt Willow2027h1, entry 897,822,079SHA-256 19bd44a6b20aecce809617b9417a95be6c0eb41d1d84d9531235f20ed1924edbPublic key SHA-256 e03e09f82a96ae2366daa45a0a4eee845096b3e9c00cdd5d0948839c61f77837
- Brand
- OpenAI
- Addresses
- 185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
- Domain
- chatgptsite.pl
- Registered
- 2026-11-02 · Aftermarket.pl Limited
- MX
- Receives mail at blackhole.aftermarket.pl
- SPF
- SPF record with -all: other senders fail
- DMARC
- DMARC policy p=reject
- Checked
- 2026-11-04 16:53 UTC
- chatgptsite.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 3 d ago
DetailsHide details for chatgptsite.pl
- Hostname
- chatgptsite.pl
- First seen
- 2026-11-02 14:47 UTC
- First published
- 2026-11-02 15:44 UTC
- DNS
- Resolves · checked 2026-11-04 15:58 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 185.253.212.22
- Latest DNS check
- Certificate
- Issued by YR1Valid 2026-11-02 13:43 UTC to 2027-01-31 13:43 UTCLogged 2026-11-02 14:42 UTC in Let's Encrypt Willow2027h1, entry 897,822,079SHA-256 19bd44a6b20aecce809617b9417a95be6c0eb41d1d84d9531235f20ed1924edbPublic key SHA-256 e03e09f82a96ae2366daa45a0a4eee845096b3e9c00cdd5d0948839c61f77837
- Brand
- OpenAI
- Addresses
- 185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
- Domain
- chatgptsite.pl
- Registered
- 2026-11-02 · Aftermarket.pl Limited
- MX
- Receives mail at blackhole.aftermarket.pl
- SPF
- SPF record with -all: other senders fail
- DMARC
- DMARC policy p=reject
- Checked
- 2026-11-04 16:53 UTC
- www.chatgptsite.com.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 3 d ago
DetailsHide details for www.chatgptsite.com.pl
- Hostname
- www.chatgptsite.com.pl
- First seen
- 2026-11-02 14:42 UTC
- First published
- 2026-11-02 15:44 UTC
- DNS
- Resolves · checked 2026-11-04 15:58 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 185.253.212.22
- Latest DNS check
- Certificate
- Issued by YR2 · precertificateValid 2026-11-02 13:41 UTC to 2027-01-31 13:41 UTCLogged 2026-11-02 14:40 UTC in Geomys Tuscolo2027h1, entry 446,428,358SHA-256 a5b21e278c027b5691f32fdb38ecd869c21872b4ba30ce37a2de8dbe67817816Public key SHA-256 bf7ad1469c2b8b248bd43ef3a97d147d3b572d91ab1c69b0af8b72bf4aaba3d7
- Brand
- OpenAI
- Addresses
- 185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
- Domain
- chatgptsite.com.pl
- Registered
- 2026-11-02 · Aftermarket.pl Limited
- MX
- Receives mail at blackhole.aftermarket.pl
- SPF
- SPF record with -all: other senders fail
- DMARC
- DMARC policy p=reject
- Checked
- 2026-11-04 16:53 UTC
- chatgptsite.com.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 3 d ago
DetailsHide details for chatgptsite.com.pl
- Hostname
- chatgptsite.com.pl
- First seen
- 2026-11-02 14:42 UTC
- First published
- 2026-11-02 15:44 UTC
- DNS
- Resolves · checked 2026-11-04 15:58 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 185.253.212.22
- Latest DNS check
- Certificate
- Issued by YR2 · precertificateValid 2026-11-02 13:41 UTC to 2027-01-31 13:41 UTCLogged 2026-11-02 14:40 UTC in Geomys Tuscolo2027h1, entry 446,428,358SHA-256 a5b21e278c027b5691f32fdb38ecd869c21872b4ba30ce37a2de8dbe67817816Public key SHA-256 bf7ad1469c2b8b248bd43ef3a97d147d3b572d91ab1c69b0af8b72bf4aaba3d7
- Brand
- OpenAI
- Addresses
- 185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
- Domain
- chatgptsite.com.pl
- Registered
- 2026-11-02 · Aftermarket.pl Limited
- MX
- Receives mail at blackhole.aftermarket.pl
- SPF
- SPF record with -all: other senders fail
- DMARC
- DMARC policy p=reject
- Checked
- 2026-11-04 16:53 UTC
- www.chatgpt-site.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 3 d ago
DetailsHide details for www.chatgpt-site.pl
- Hostname
- www.chatgpt-site.pl
- First seen
- 2026-11-02 13:47 UTC
- First published
- 2026-11-02 14:21 UTC
- DNS
- Resolves · checked 2026-11-04 14:41 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 185.253.212.22
- Latest DNS check
- Certificate
- Issued by YR1 · precertificateValid 2026-11-02 12:44 UTC to 2027-01-31 12:44 UTCLogged 2026-11-02 13:43 UTC in IPng Networks Gouda2027h1, entry 293,845,083SHA-256 0c40b3143d1316cfa63f9b6b5a1578d423dce1f3c10bad0f708d14b2417e0955Public key SHA-256 2123f35423a841641cdc92e26389fad9bb3d0fe6e3b5b89c94a6823adeae7716
- Brand
- OpenAI
- Addresses
- 185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
- Domain
- chatgpt-site.pl
- Registered
- 2026-11-02 · Aftermarket.pl Limited
- MX
- Receives mail at blackhole.aftermarket.pl
- SPF
- SPF record with -all: other senders fail
- DMARC
- DMARC policy p=reject
- Checked
- 2026-11-04 14:34 UTC
- chatgpt-site.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 3 d ago
DetailsHide details for chatgpt-site.pl
- Hostname
- chatgpt-site.pl
- First seen
- 2026-11-02 13:47 UTC
- First published
- 2026-11-02 14:21 UTC
- DNS
- Resolves · checked 2026-11-04 14:41 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 185.253.212.22
- Latest DNS check
- Certificate
- Issued by YR1 · precertificateValid 2026-11-02 12:44 UTC to 2027-01-31 12:44 UTCLogged 2026-11-02 13:43 UTC in IPng Networks Gouda2027h1, entry 293,845,083SHA-256 0c40b3143d1316cfa63f9b6b5a1578d423dce1f3c10bad0f708d14b2417e0955Public key SHA-256 2123f35423a841641cdc92e26389fad9bb3d0fe6e3b5b89c94a6823adeae7716
- Brand
- OpenAI
- Addresses
- 185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
- Domain
- chatgpt-site.pl
- Registered
- 2026-11-02 · Aftermarket.pl Limited
- MX
- Receives mail at blackhole.aftermarket.pl
- SPF
- SPF record with -all: other senders fail
- DMARC
- DMARC policy p=reject
- Checked
- 2026-11-04 14:34 UTC
- api.chatgptpro.site HK · AS55933 · Cloudie LimitedSpamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 2 mo ago
DetailsHide details for api.chatgptpro.site
- Hostname
- api.chatgptpro.site
- First seen
- 2026-11-02 13:47 UTC
- First published
- 2026-11-02 14:21 UTC
- DNS
- Resolves · checked 2026-11-04 14:41 UTC
- Spamhaus DROP
- A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 103.30.41.230.
- Spamhaus DROP list fetched with the address
- Certificate logged in CT
- Resolved to 103.30.41.230
- Latest DNS check
- Certificate
- Issued by YE1 · precertificateValid 2026-11-02 12:45 UTC to 2027-01-31 12:45 UTCLogged 2026-11-02 13:44 UTC in DigiCert Sphinx2027h1, entry 334,806,092SHA-256 5822eaa12ddae00dfa23a6e9338d7ceae4b561dcc98bb602c42de307d40c49ffPublic key SHA-256 e2b333f7d60024c1549d347c8ec9d6766c82d2772977cc4d5af1865a1056485c
- Brand
- OpenAI
- Addresses
- 103.30.41.230 · Hong Kong · AS55933 CLOUDIE-AS-AP - Cloudie Limited
- Domain
- chatgptpro.site
- Registered
- 2026-09-03 · DNSPod, Inc.
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 14:34 UTC
- openai3420.com AU · AS133618 · Trellian Pty. LimitedListedParking page · Above.comListed by NPA 165 (finance and insurance)MX presentSPF -allDMARC missingRegistered 12 mo ago
DetailsHide details for openai3420.com
- Hostname
- openai3420.com
- First seen
- 2026-11-02 07:26 UTC
- First published
- 2026-11-02 08:00 UTC
- Listing
- NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 01:32 UTC
- DNS
- Resolves · checked 2026-11-05 08:04 UTC
- Listed
- NPA 165
- Observed in the NPA 165 feed
- Certificate logged in CT
- We matched its certificate name
- Latest DNS check
- Certificate
- Issued by YE2Valid 2026-11-02 06:22 UTC to 2027-01-31 06:22 UTCLogged 2026-11-02 07:20 UTC in Google PlumbersArms2027h1, entry 568,267,803SHA-256 3a15defb939a65957cca3b50cb14c789598c883cf7533488084941625e480619Public key SHA-256 ebb7621e502f6614adf165455dc910f3c23f4b8159fb7c8a949350cb39e9ad4b
- Brand
- OpenAI
- Addresses
- 103.224.212.141 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
- Parking page · Above.com
- The registry delegates openai3420.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.212.141): a parking service. It answers for names that are typically for sale or unused.
- Domain
- openai3420.com
- Registered
- 2025-11-01 · Dynadot Inc
- MX
- Receives mail at park-mx.above.com
- SPF
- SPF record with -all: other senders fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:54 UTC
- openai9315.com AU · AS133618 · Trellian Pty. LimitedListedParking page · Above.comListed by NPA 165 (finance and insurance)MX presentSPF -allDMARC missingRegistered 12 mo ago
DetailsHide details for openai9315.com
- Hostname
- openai9315.com
- First seen
- 2026-11-01 20:10 UTC
- First published
- 2026-11-01 20:16 UTC
- Listing
- NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 01:32 UTC
- DNS
- Resolves · checked 2026-11-04 20:20 UTC
- Listed
- NPA 165
- Observed in the NPA 165 feed
- Certificate logged in CT
- We matched its certificate name
- Latest DNS check
- Certificate
- Issued by YE2Valid 2026-11-01 19:07 UTC to 2027-01-30 19:07 UTCLogged 2026-11-01 20:05 UTC in Google ParcelYard2027h1, entry 560,362,877SHA-256 2185ce1dc6a502da229a92377ed148ae0e04e65a5f783b36e6e3877c0f0247c6Public key SHA-256 1d9c23c59d3272ab4ba9bab522730822f4d31a78da38b936a385703b94b2fbc0
- Brand
- OpenAI
- Addresses
- 103.224.182.250 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
- Parking page · Above.com
- The registry delegates openai9315.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.250): a parking service. It answers for names that are typically for sale or unused.
- Domain
- openai9315.com
- Registered
- 2025-11-01 · Dynadot Inc
- MX
- Receives mail at park-mx.above.com
- SPF
- SPF record with -all: other senders fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 20:39 UTC
- openai1459.com AU · AS133618 · Trellian Pty. LimitedListedParking page · Above.comListed by NPA 165 (finance and insurance)MX presentSPF -allDMARC missingRegistered 12 mo ago
DetailsHide details for openai1459.com
- Hostname
- openai1459.com
- First seen
- 2026-11-01 18:06 UTC
- First published
- 2026-11-01 19:10 UTC
- Listing
- NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 01:32 UTC
- DNS
- Resolves · checked 2026-11-04 19:20 UTC
- Listed
- NPA 165
- Observed in the NPA 165 feed
- Certificate logged in CT
- We matched its certificate name
- Latest DNS check
- Certificate
- Issued by YE1 · precertificateValid 2026-11-01 17:02 UTC to 2027-01-30 17:02 UTCLogged 2026-11-01 18:00 UTC in Let's Encrypt Willow2027h1, entry 883,383,821SHA-256 2cf90ef45ad7fc6324cc8241156b3d5ad9fa82fe45bc82a19dd4b9d637425e8bPublic key SHA-256 dc2e8bfe36d41961f0f0131cb0501910bed42b5a9c4b063e2cb127711679a42a
- Brand
- OpenAI
- Addresses
- 103.224.182.248 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
- Parking page · Above.com
- The registry delegates openai1459.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.248): a parking service. It answers for names that are typically for sale or unused.
- Domain
- openai1459.com
- Registered
- 2025-11-01 · Dynadot Inc
- MX
- Receives mail at park-mx.above.com
- SPF
- SPF record with -all: other senders fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 19:26 UTC
- openai3034.com AU · AS133618 · Trellian Pty. LimitedListedParking page · Above.comListed by NPA 165 (finance and insurance)MX presentSPF -allDMARC missingRegistered 12 mo ago
DetailsHide details for openai3034.com
- Hostname
- openai3034.com
- First seen
- 2026-11-01 16:05 UTC
- First published
- 2026-11-01 16:25 UTC
- Listing
- NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 01:32 UTC
- DNS
- Resolves · checked 2026-11-04 16:31 UTC
- Listed
- NPA 165
- Observed in the NPA 165 feed
- Certificate logged in CT
- We matched its certificate name
- Latest DNS check
- Certificate
- Issued by YE1Valid 2026-11-01 15:02 UTC to 2027-01-30 15:02 UTCLogged 2026-11-01 16:00 UTC in Google ParcelYard2027h1, entry 557,525,728SHA-256 facdb2794f3cecaf2cda0e876f3aa28c52fcff13607be7f862dd4e4a640bb443Public key SHA-256 d7a18f9311e0614633dce503711a8b55b4f1cb0aecab7aa6c5adebc4369ff096
- Brand
- OpenAI
- Addresses
- 103.224.182.250 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
- Parking page · Above.com
- The registry delegates openai3034.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.250): a parking service. It answers for names that are typically for sale or unused.
- Domain
- openai3034.com
- Registered
- 2025-11-01 · Dynadot Inc
- MX
- Receives mail at park-mx.above.com
- SPF
- SPF record with -all: other senders fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 17:09 UTC
- openai6706.com AU · AS133618 · Trellian Pty. LimitedListedParking page · Above.comListed by NPA 165 (finance and insurance)MX presentSPF -allDMARC missingRegistered 12 mo ago
DetailsHide details for openai6706.com
- Hostname
- openai6706.com
- First seen
- 2026-11-01 16:05 UTC
- First published
- 2026-11-01 16:25 UTC
- Listing
- NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 01:32 UTC
- DNS
- Resolves · checked 2026-11-04 16:31 UTC
- Listed
- NPA 165
- Observed in the NPA 165 feed
- Certificate logged in CT
- We matched its certificate name
- Latest DNS check
- Certificate
- Issued by YE1Valid 2026-11-01 15:02 UTC to 2027-01-30 15:02 UTCLogged 2026-11-01 16:00 UTC in Google ParcelYard2027h1, entry 557,525,728SHA-256 facdb2794f3cecaf2cda0e876f3aa28c52fcff13607be7f862dd4e4a640bb443Public key SHA-256 d7a18f9311e0614633dce503711a8b55b4f1cb0aecab7aa6c5adebc4369ff096
- Brand
- OpenAI
- Addresses
- 103.224.182.250 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
- Parking page · Above.com
- The registry delegates openai6706.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.250): a parking service. It answers for names that are typically for sale or unused.
- Domain
- openai6706.com
- Registered
- 2025-11-01 · Dynadot Inc
- MX
- Receives mail at park-mx.above.com
- SPF
- SPF record with -all: other senders fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 17:09 UTC
- openai5468.com AU · AS133618 · Trellian Pty. LimitedListedParking page · Above.comListed by NPA 165 (finance and insurance)MX presentSPF -allDMARC missingRegistered 12 mo ago
DetailsHide details for openai5468.com
- Hostname
- openai5468.com
- First seen
- 2026-11-01 15:41 UTC
- First published
- 2026-11-01 16:25 UTC
- Listing
- NPA 165: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 01:32 UTC
- DNS
- Resolves · checked 2026-11-04 16:31 UTC
- Listed
- NPA 165
- Observed in the NPA 165 feed
- Certificate logged in CT
- We matched its certificate name
- Latest DNS check
- Certificate
- Issued by YE1 · precertificateValid 2026-11-01 14:38 UTC to 2027-01-30 14:38 UTCLogged 2026-11-01 15:36 UTC in Let's Encrypt Sycamore2027h1, entry 889,080,259SHA-256 1c31b7f430ebc76b463e74755e3be0d4ce85e36c310a5cfc57ef190847a01631Public key SHA-256 8b8d5159fa49a6666206e3b464b24efc949a83e41e5ecfdd701d179fcceb02a0
- Brand
- OpenAI
- Addresses
- 103.224.182.250 · Australia · AS133618 TRELLIAN-AS-AP - Trellian Pty. Limited · Trellian / Above.com (parking page)
- Parking page · Above.com
- The registry delegates openai5468.com to Above.com’s nameservers, which answer for it. Above.com: a parking service. It answers for names that are typically for sale or unused. Trellian / Above.com (103.224.182.250): a parking service. It answers for names that are typically for sale or unused.
- Domain
- openai5468.com
- Registered
- 2025-11-01 · Dynadot Inc
- MX
- Receives mail at park-mx.above.com
- SPF
- SPF record with -all: other senders fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 17:09 UTC
- uk.chatgpt5.se SE · AS41528 · LOOPIA3 Loopia ABPhishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF ?allDMARC missing
DetailsHide details for uk.chatgpt5.se
- Hostname
- uk.chatgpt5.se
- First seen
- 2026-11-01 01:25 UTC
- First published
- 2026-11-01 01:31 UTC
- DNS
- Resolves · checked 2026-11-05 01:39 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 109.235.174.19.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 109.235.174.19
- Latest DNS check
- Certificate
- Issued by YR1Valid 2026-11-01 00:21 UTC to 2027-01-30 00:21 UTCLogged 2026-11-01 01:20 UTC in Google ParcelYard2027h1, entry 548,140,494SHA-256 7d13f3d18ce41410161eb4a3502278d2800b07080cb42386fdc21c90bd8f80efPublic key SHA-256 2d9b757198d48e962cd44d6794c8472d048aa21a7ca13968e7249dc9dd708dff
- Brand
- OpenAI
- Addresses
- 109.235.174.19 · Sweden · AS41528 LOOPIA3 Loopia AB
- Domain
- chatgpt5.se
- MX
- Publishes no mail exchanger
- SPF
- SPF record with ?all: other senders are neutral
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 03:07 UTC
- www.uk.chatgpt5.se SE · AS41528 · LOOPIA3 Loopia ABPhishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF ?allDMARC missing
DetailsHide details for www.uk.chatgpt5.se
- Hostname
- www.uk.chatgpt5.se
- First seen
- 2026-11-01 01:25 UTC
- First published
- 2026-11-01 01:31 UTC
- DNS
- Resolves · checked 2026-11-05 01:39 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 109.235.174.19.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 109.235.174.19
- Latest DNS check
- Certificate
- Issued by YR1Valid 2026-11-01 00:21 UTC to 2027-01-30 00:21 UTCLogged 2026-11-01 01:20 UTC in Google ParcelYard2027h1, entry 548,140,494SHA-256 7d13f3d18ce41410161eb4a3502278d2800b07080cb42386fdc21c90bd8f80efPublic key SHA-256 2d9b757198d48e962cd44d6794c8472d048aa21a7ca13968e7249dc9dd708dff
- Brand
- OpenAI
- Addresses
- 109.235.174.19 · Sweden · AS41528 LOOPIA3 Loopia AB
- Domain
- chatgpt5.se
- MX
- Publishes no mail exchanger
- SPF
- SPF record with ?all: other senders are neutral
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 03:07 UTC
- chatgpt-brief.com US · AS16509 · Amazon.com, Inc.ListedAmazon Web ServicesListed by USOMMX presentSPF ~allDMARC policy noneRegistered 4 mo ago
DetailsHide details for chatgpt-brief.com
- Hostname
- chatgpt-brief.com
- First seen
- 2026-10-31 22:25 UTC
- First published
- 2026-10-31 22:45 UTC
- Listing
- USOM listed it 2026-10-07 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:43 UTC
- DNS
- Resolves · checked 2026-11-04 22:58 UTC
- Listed
- USOM
- Listed by USOM
- Certificate logged in CT
- We matched its certificate name
- Latest DNS check
- Certificate
- Issued by YR1Valid 2026-10-31 21:22 UTC to 2027-01-29 21:22 UTCLogged 2026-10-31 22:20 UTC in Google PlumbersArms2027h1, entry 546,482,685SHA-256 1306e55aa9dde19d7bae7cfbcaf9f28e52da36abf5bd3d88a520087f18c107d4Public key SHA-256 829cde70f9df3a17d5e0be52258041a2d85d7753a5bd949190e4fc70da8fb19d
- Brand
- OpenAI
- Addresses
- 216.150.1.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
- Amazon Web Services
- Amazon Web Services (216.150.1.1): a cloud provider. It rents servers and addresses to its customers.
- Domain
- chatgpt-brief.com
- Registered
- 2026-06-30 · Ultahost, Inc.
- MX
- Receives mail at mx1.improvmx.com, mx2.improvmx.com
- SPF
- SPF record with ~all: other senders soft-fail
- DMARC
- DMARC policy p=none: reports only
- Checked
- 2026-11-04 23:22 UTC
- wildcard.wildcard.wildcard.wildcard.wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…Phishing hostAddress hosted confirmed phishing in the last 48 h
DetailsHide details for wildcard.wildcard.wildcard.wildcard.wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- Hostname
- wildcard.wildcard.wildcard.wildcard.wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- First seen
- 2026-10-30 20:11 UTC
- First published
- 2026-10-30 20:43 UTC
- DNS
- Resolves · checked 2026-11-04 20:47 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 5.161.23.223
- Latest DNS check
- Certificate
- Issued by YE2 · precertificateValid 2026-10-30 19:09 UTC to 2027-01-28 19:09 UTCLogged 2026-10-30 20:08 UTC in Let's Encrypt Willow2027h1, entry 854,337,399SHA-256 0f7ef7014dab249ec254cd348a41046d3afc056dc08b7f2e9b74a9b8caa9cb7ePublic key SHA-256 c4ed12098f1b9e128aa99fa2bb8b2e57431852f374ed1ad5c0beea632b2104e0
- Brand
- OpenAI
- Addresses
- 5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
- wildcard.wildcard.wildcard.wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…Phishing hostAddress hosted confirmed phishing in the last 48 h
DetailsHide details for wildcard.wildcard.wildcard.wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- Hostname
- wildcard.wildcard.wildcard.wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- First seen
- 2026-10-30 20:11 UTC
- First published
- 2026-10-30 20:43 UTC
- DNS
- Resolves · checked 2026-11-04 20:47 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 5.161.23.223
- Latest DNS check
- Certificate
- Issued by YE2 · precertificateValid 2026-10-30 19:09 UTC to 2027-01-28 19:09 UTCLogged 2026-10-30 20:08 UTC in IPng Networks Gouda2027h1, entry 272,841,314SHA-256 2bf8bfc035eecabbf4e14bb81e8c0350f9b5f1283d28699a8e80fde7a7435d1dPublic key SHA-256 d54080598c1e473a43d3a4a6226a537894136c696d2dfc80d97ad25a0e8c7f44
- Brand
- OpenAI
- Addresses
- 5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
- wildcard.mcp-chatgpt-starter.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…Phishing hostAddress hosted confirmed phishing in the last 48 h
DetailsHide details for wildcard.mcp-chatgpt-starter.wasmer.app
- Hostname
- wildcard.mcp-chatgpt-starter.wasmer.app
- First seen
- 2026-10-30 20:11 UTC
- First published
- 2026-10-30 20:43 UTC
- DNS
- Resolves · checked 2026-11-04 20:47 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 5.161.23.223
- Latest DNS check
- Certificate
- Issued by YE1 · precertificateValid 2026-10-30 19:08 UTC to 2027-01-28 19:08 UTCLogged 2026-10-30 20:07 UTC in Geomys Tuscolo2027h1, entry 411,596,171SHA-256 76f794f4527138c03b1410b96955cbc3011748ea17d7281012de74dbfea9bbedPublic key SHA-256 ceeb2e7e9107546b2d2d49bb99be14a6937ea0bfd0e8b4c98c8a6f653df0ef22
- Brand
- OpenAI
- Addresses
- 5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
- mcp-chatgpt-starter.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…Phishing hostAddress hosted confirmed phishing in the last 48 h
DetailsHide details for mcp-chatgpt-starter.wasmer.app
- Hostname
- mcp-chatgpt-starter.wasmer.app
- First seen
- 2026-10-30 16:06 UTC
- First published
- 2026-10-30 17:03 UTC
- DNS
- Resolves · checked 2026-11-04 17:12 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 5.161.23.223
- Latest DNS check
- Certificate
- Issued by YE1 · precertificateValid 2026-10-30 15:05 UTC to 2027-01-28 15:05 UTCLogged 2026-10-30 16:04 UTC in Geomys Tuscolo2027h1, entry 409,381,763SHA-256 4c4ece5f40f98095bc0103a6d84af5a0f7e0fc826ca2ac6ec86a016c8cbd37e1Public key SHA-256 9fd27b9914ba48b02464672ce7c59dc7be2e755a0ce5f051a6a0ec5faace9bb7
- Brand
- OpenAI
- Addresses
- 5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
- www.chatgpt60.com US · AS54600 · PEG TECH INCPhishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
DetailsHide details for www.chatgpt60.com
- Hostname
- www.chatgpt60.com
- First seen
- 2026-10-30 16:01 UTC
- First published
- 2026-10-30 17:03 UTC
- DNS
- Resolves · checked 2026-11-04 17:13 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 107.148.207.252.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 107.148.207.252
- Certificate
- Issued by YE2Valid 2026-10-30 14:58 UTC to 2027-01-28 14:58 UTCLogged 2026-10-30 15:57 UTC in Google ParcelYard2027h1, entry 524,940,891SHA-256 49a96ab094122beebb64047b9864e61560495330eb7ad000703fe6106f9bc133Public key SHA-256 9ca2f37974e11b924c37c219b5b524bf0e1f6ffc6b17455f8f93e061a68e86c5
- Brand
- OpenAI
- Addresses
- 107.148.207.252 · United States · AS54600 PEG-SV - PEG TECH INC
- Domain
- chatgpt60.com
- Registered
- 2026-07-19 · GMO Internet Group, Inc. d/b/a Onamae.com
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 20:39 UTC
- www.openai-lab.com HK · AS152194 · CTG Server LimitedSpamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 6 mo ago
DetailsHide details for www.openai-lab.com
- Hostname
- www.openai-lab.com
- First seen
- 2026-10-30 13:01 UTC
- First published
- 2026-10-30 13:53 UTC
- DNS
- Resolves · checked 2026-11-04 14:01 UTC
- Spamhaus DROP
- A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 137.220.145.81.
- Spamhaus DROP list fetched with the address
- Certificate logged in CT
- Resolved to 137.220.145.81
- Latest DNS check
- Certificate
- Issued by YR1Valid 2026-10-30 11:57 UTC to 2027-01-28 11:57 UTCLogged 2026-10-30 12:56 UTC in Google PlumbersArms2027h1, entry 523,412,746SHA-256 0e910676a2bb27f891bc69882ced3f72eff049a8a9640266f65ef8e86d88eb69Public key SHA-256 7a4b825202833b18936c4f09bcc6441b2c21cd2e17755a1df8fb422f277684ea
- Brand
- OpenAI
- Addresses
- 137.220.145.81 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
- Domain
- openai-lab.com
- Registered
- 2026-05-01 · Gname 134 Inc
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 16:53 UTC
- openai-lab.com HK · AS152194 · CTG Server LimitedSpamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 6 mo ago
DetailsHide details for openai-lab.com
- Hostname
- openai-lab.com
- First seen
- 2026-10-30 13:01 UTC
- First published
- 2026-10-30 13:53 UTC
- DNS
- Resolves · checked 2026-11-04 14:01 UTC
- Spamhaus DROP
- A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 137.220.145.81.
- Spamhaus DROP list fetched with the address
- Certificate logged in CT
- Resolved to 137.220.145.81
- Latest DNS check
- Certificate
- Issued by YR1Valid 2026-10-30 11:57 UTC to 2027-01-28 11:57 UTCLogged 2026-10-30 12:56 UTC in Google PlumbersArms2027h1, entry 523,412,746SHA-256 0e910676a2bb27f891bc69882ced3f72eff049a8a9640266f65ef8e86d88eb69Public key SHA-256 7a4b825202833b18936c4f09bcc6441b2c21cd2e17755a1df8fb422f277684ea
- Brand
- OpenAI
- Addresses
- 137.220.145.81 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
- Domain
- openai-lab.com
- Registered
- 2026-05-01 · Gname 134 Inc
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 16:53 UTC
- m.openai-lab.com HK · AS152194 · CTG Server LimitedSpamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 6 mo ago
DetailsHide details for m.openai-lab.com
- Hostname
- m.openai-lab.com
- First seen
- 2026-10-30 13:01 UTC
- First published
- 2026-10-30 13:53 UTC
- DNS
- Resolves · checked 2026-11-04 14:01 UTC
- Spamhaus DROP
- A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 137.220.145.81.
- Spamhaus DROP list fetched with the address
- Certificate logged in CT
- Resolved to 137.220.145.81
- Latest DNS check
- Certificate
- Issued by YR1Valid 2026-10-30 11:57 UTC to 2027-01-28 11:57 UTCLogged 2026-10-30 12:56 UTC in Google PlumbersArms2027h1, entry 523,412,746SHA-256 0e910676a2bb27f891bc69882ced3f72eff049a8a9640266f65ef8e86d88eb69Public key SHA-256 7a4b825202833b18936c4f09bcc6441b2c21cd2e17755a1df8fb422f277684ea
- Brand
- OpenAI
- Addresses
- 137.220.145.81 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
- Domain
- openai-lab.com
- Registered
- 2026-05-01 · Gname 134 Inc
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 16:53 UTC
- img.openai-lab.com HK · AS152194 · CTG Server LimitedSpamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 6 mo ago
DetailsHide details for img.openai-lab.com
- Hostname
- img.openai-lab.com
- First seen
- 2026-10-30 13:01 UTC
- First published
- 2026-10-30 13:53 UTC
- DNS
- Resolves · checked 2026-11-04 14:01 UTC
- Spamhaus DROP
- A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 137.220.145.81.
- Spamhaus DROP list fetched with the address
- Certificate logged in CT
- Resolved to 137.220.145.81
- Latest DNS check
- Certificate
- Issued by YR1Valid 2026-10-30 11:57 UTC to 2027-01-28 11:57 UTCLogged 2026-10-30 12:56 UTC in Google PlumbersArms2027h1, entry 523,412,746SHA-256 0e910676a2bb27f891bc69882ced3f72eff049a8a9640266f65ef8e86d88eb69Public key SHA-256 7a4b825202833b18936c4f09bcc6441b2c21cd2e17755a1df8fb422f277684ea
- Brand
- OpenAI
- Addresses
- 137.220.145.81 · Hong Kong · AS152194 CTGSERVERLIMITED-AS-AP - CTG Server Limited
- Domain
- openai-lab.com
- Registered
- 2026-05-01 · Gname 134 Inc
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 16:53 UTC
- www.chatgpt-farsi.com IR · AS205585 · ARVANCLOUD-CDN-IR Noyan Abr…2 addressesPhishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 y ago
DetailsHide details for www.chatgpt-farsi.com
- Hostname
- www.chatgpt-farsi.com
- First seen
- 2026-10-30 07:06 UTC
- First published
- 2026-10-30 07:37 UTC
- DNS
- Resolves · checked 2026-11-05 07:49 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.143.233.133.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 185.143.233.133
- Latest DNS check
- Certificate
- Issued by YR2Valid 2026-10-30 06:02 UTC to 2027-01-28 06:02 UTCLogged 2026-10-30 07:01 UTC in Google ParcelYard2027h1, entry 518,504,184SHA-256 3c929a0f3a84aa71182deacfa6b57f3ac8da1c33b16e95e0532c54cbd77ceac1Public key SHA-256 c34d517afa67bcf12b71874eda01da88689921d5d03c210ebfcfb3eeec774e09
- Brand
- OpenAI
- Addresses
- 185.143.233.133 · Iran · AS205585 ARVANCLOUD-CDN-IR Noyan Abr Arvan Co. ( Private Joint Stock)185.143.234.133 · Iran · AS205585 ARVANCLOUD-CDN-IR Noyan Abr Arvan Co. ( Private Joint Stock)
- Domain
- chatgpt-farsi.com
- Registered
- 2023-03-29 · CSL Computer Service Langenbach GmbH d/b/a joker.com
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 10:04 UTC
- chatgpt-farsi.com IR · AS205585 · ARVANCLOUD-CDN-IR Noyan Abr…2 addressesPhishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 y ago
DetailsHide details for chatgpt-farsi.com
- Hostname
- chatgpt-farsi.com
- First seen
- 2026-10-30 07:06 UTC
- First published
- 2026-10-30 07:37 UTC
- DNS
- Resolves · checked 2026-11-05 07:49 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.143.233.133.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 185.143.233.133
- Latest DNS check
- Certificate
- Issued by YR2Valid 2026-10-30 06:02 UTC to 2027-01-28 06:02 UTCLogged 2026-10-30 07:01 UTC in Google ParcelYard2027h1, entry 518,504,184SHA-256 3c929a0f3a84aa71182deacfa6b57f3ac8da1c33b16e95e0532c54cbd77ceac1Public key SHA-256 c34d517afa67bcf12b71874eda01da88689921d5d03c210ebfcfb3eeec774e09
- Brand
- OpenAI
- Addresses
- 185.143.233.133 · Iran · AS205585 ARVANCLOUD-CDN-IR Noyan Abr Arvan Co. ( Private Joint Stock)185.143.234.133 · Iran · AS205585 ARVANCLOUD-CDN-IR Noyan Abr Arvan Co. ( Private Joint Stock)
- Domain
- chatgpt-farsi.com
- Registered
- 2023-03-29 · CSL Computer Service Langenbach GmbH d/b/a joker.com
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 10:04 UTC
- openai-chatgpt4.online DE · AS212317 · HETZNER-CLOUD3-AS Hetzner O…5 addressesPhishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 10 mo ago
DetailsHide details for openai-chatgpt4.online
- Hostname
- openai-chatgpt4.online
- First seen
- 2026-10-30 01:57 UTC
- First published
- 2026-10-30 02:55 UTC
- DNS
- Resolves · checked 2026-11-05 03:03 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.78.156.59.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 5.78.156.59
- Latest DNS check
- Certificate
- Issued by YE2Valid 2026-10-30 00:53 UTC to 2027-01-28 00:53 UTCLogged 2026-10-30 01:52 UTC in TrustAsia Luoshu2027, entry 469,413,365SHA-256 a6f40b8e4ee7f3703ca0bb7b3ff9a1d2b4c08c89d6faa895a5537575a6a3000bPublic key SHA-256 e75a666dfe6f112e8d889acb870aab868a6f19474c6e65748b1fb3dfd842a249
- Brand
- OpenAI
- Addresses
- 5.78.156.59 · Germany · AS212317 HETZNER-CLOUD3-AS Hetzner Online GmbH5.161.47.86 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH5.161.230.87 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH46.62.237.138 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)195.201.128.179 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
- Hetzner
- Hetzner (46.62.237.138, 195.201.128.179): a cloud provider. It rents servers and addresses to its customers.
- Domain
- openai-chatgpt4.online
- Registered
- 2025-12-31 · VIRTUA DRUG Kutatási Szolgáltató Korlátolt Felelősségű Társaság
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 03:54 UTC
- wildcard.wildcard.wildcard.wildcard.www.wildcard.chatgpt-wasmer-app-deployments.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…Phishing hostAddress hosted confirmed phishing in the last 48 h
DetailsHide details for wildcard.wildcard.wildcard.wildcard.www.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- Hostname
- wildcard.wildcard.wildcard.wildcard.www.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- First seen
- 2026-10-29 17:11 UTC
- First published
- 2026-10-29 17:26 UTC
- DNS
- Resolves · checked 2026-11-04 17:34 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 5.161.23.223
- Latest DNS check
- Certificate
- Issued by YE2Valid 2026-10-29 16:07 UTC to 2027-01-27 16:07 UTCLogged 2026-10-29 17:05 UTC in Google ParcelYard2027h1, entry 509,162,878SHA-256 699150c95be9d0bf8359f344763783fd6af854e31cc04840e2a5e08cc3826b9dPublic key SHA-256 327694f0160cfe57c4e074819689dc922ee592f31f367e17d688f1695a5d2acc
- Brand
- OpenAI
- Addresses
- 5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
- chatgpt-girlfriend.com US · AS13335 · Cloudflare, Inc.4 addressesReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 d ago
DetailsHide details for chatgpt-girlfriend.com
- Hostname
- chatgpt-girlfriend.com
- First seen
- 2026-10-29 05:37 UTC
- First published
- 2026-10-29 05:41 UTC
- Listing
- PhishDestroy: first observed in the feed 2026-10-29 · still listed at the last successful feed check 2026-11-05 05:51 UTC
- DNS
- Resolves · checked 2026-11-05 05:51 UTC
- Reported
- PhishDestroy
- Certificate logged in CT
- Observed in the PhishDestroy feed
- We matched the new listing
- Latest DNS check
- Certificate
- Issued by Sectigo Public Server Authentication CA DV E36 · precertificateValid 2026-10-28 00:00 UTC to 2027-01-25 23:20 UTCLogged 2026-10-28 01:51 UTC in DigiCert Wyvern2027h1, entry 327,668,097SHA-256 961f2954f739c707ff3a285a6b474f88a776c85a2a7f5b6b6258752d7f0fb4b7Public key SHA-256 84b89d8258746efe394782e6dcdc7239ddbd3ac99b897c4e50b0db1bd33eff64
- PhishDestroy
- Brand
- OpenAI
- Addresses
- 104.21.75.110 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)172.67.222.106 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)2606:4700:3031::6815:4b6e2606:4700:3036::ac43:de6a
- Cloudflare
- Cloudflare (104.21.75.110, 172.67.222.106): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
- Domain
- chatgpt-girlfriend.com
- Registered
- 2026-10-27 · PDR Ltd. d/b/a PublicDomainRegistry.com
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:54 UTC
- favorites-openai.com US · AS13335 · Cloudflare, Inc.4 addressesReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 9 d ago
DetailsHide details for favorites-openai.com
- Hostname
- favorites-openai.com
- First seen
- 2026-10-29 05:37 UTC
- First published
- 2026-10-29 05:41 UTC
- Listing
- PhishDestroy: first observed in the feed 2026-10-29 · still listed at the last successful feed check 2026-11-05 05:51 UTC
- DNS
- Resolves · checked 2026-11-05 05:51 UTC
- Reported
- PhishDestroy
- Certificate logged in CT
- Observed in the PhishDestroy feed
- We matched the new listing
- Latest DNS check
- Certificate
- Issued by YE2 · precertificateValid 2026-10-27 22:45 UTC to 2027-01-25 22:45 UTCLogged 2026-10-27 23:43 UTC in Let's Encrypt Sycamore2027h1, entry 810,514,023SHA-256 880464fa2ac14f2fd2f41430bafe2951148a902b32c91043656d981b44d00141Public key SHA-256 4865e38d3bfc4ecd9cbae9fd709d915b091720eff439e3b7ed1d3ea701832045
- PhishDestroy
- Brand
- OpenAI
- Addresses
- 104.21.58.36 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)172.67.199.125 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)2606:4700:3032::ac43:c77d2606:4700:3033::6815:3a24
- Cloudflare
- Cloudflare (104.21.58.36, 172.67.199.125): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
- Domain
- favorites-openai.com
- Registered
- 2026-10-27 · Tucows Domains Inc.
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:54 UTC
- wildcard.wildcard.wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…Phishing hostAddress hosted confirmed phishing in the last 48 h
DetailsHide details for wildcard.wildcard.wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- Hostname
- wildcard.wildcard.wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- First seen
- 2026-10-28 19:00 UTC
- First published
- 2026-10-28 19:20 UTC
- DNS
- Resolves · checked 2026-11-04 19:31 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 5.161.23.223
- Latest DNS check
- Certificate
- Issued by YE2 · precertificateValid 2026-10-28 18:01 UTC to 2027-01-26 18:01 UTCLogged 2026-10-28 18:59 UTC in DigiCert Wyvern2027h1, entry 337,859,987SHA-256 d7778d28ad11d6ae362169920c189df4583cfe208d2994b39a6743cadd83808ePublic key SHA-256 f23f2a6d441446284658a0dded0d5bf3949b9f5bd271237678c726fcbb25fdb8
- Brand
- OpenAI
- Addresses
- 5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
- wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…Phishing hostAddress hosted confirmed phishing in the last 48 h
DetailsHide details for wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- Hostname
- wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- First seen
- 2026-10-28 16:01 UTC
- First published
- 2026-10-28 16:14 UTC
- DNS
- Resolves · checked 2026-11-04 16:21 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 5.161.23.223
- Latest DNS check
- Certificate
- Issued by YE2 · precertificateValid 2026-10-28 14:59 UTC to 2027-01-26 14:59 UTCLogged 2026-10-28 15:58 UTC in Let's Encrypt Willow2027h1, entry 817,296,732SHA-256 4ac41a36c8572b9eb1632f8654b474618f0135d7297b788ac9aaef3372115526Public key SHA-256 3384b7af947382c469b98b7383e757480504689ba664c367b67ddf9b4f2ab2ab
- Brand
- OpenAI
- Addresses
- 5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
- wildcard.wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…Phishing hostAddress hosted confirmed phishing in the last 48 h
DetailsHide details for wildcard.wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- Hostname
- wildcard.wildcard.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- First seen
- 2026-10-28 15:47 UTC
- First published
- 2026-10-28 16:14 UTC
- DNS
- Resolves · checked 2026-11-04 16:21 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 5.161.23.223
- Latest DNS check
- Certificate
- Issued by YE2Valid 2026-10-28 14:47 UTC to 2027-01-26 14:47 UTCLogged 2026-10-28 15:45 UTC in Google ParcelYard2027h1, entry 490,825,032SHA-256 f113dca9040cd55625cb329af904f61baf0fd38a2c77814841fb3324e47ee469Public key SHA-256 dda99410638140be70ded4f5507638ef6e7a45be203e3c59f704233682dbdefb
- Brand
- OpenAI
- Addresses
- 5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
- wildcard.wildcard.www.www.wildcard.chatgpt-wasmer-app-deployments.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…Phishing hostAddress hosted confirmed phishing in the last 48 h
DetailsHide details for wildcard.wildcard.www.www.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- Hostname
- wildcard.wildcard.www.www.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- First seen
- 2026-10-27 13:22 UTC
- DNS
- Resolves · checked 2026-11-05 09:01 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
- Phishing-host list fetched with the address
- Resolved to 5.161.23.223
- Latest DNS check
- Certificate
- Logged in Geomys Tuscolo2027h1, entry 370,919,927SHA-256 3f337277646d87f4370945eebec40e25d45b2c947cc110812a44dc99d8c6c047
- Brand
- OpenAI
- Addresses
- 5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
- wildcard.wildcard.www.www.www.wildcard.chatgpt-wasmer-app-deployments.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…Phishing hostAddress hosted confirmed phishing in the last 48 h
DetailsHide details for wildcard.wildcard.www.www.www.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- Hostname
- wildcard.wildcard.www.www.www.wildcard.chatgpt-wasmer-app-deployments.wasmer.app
- First seen
- 2026-10-26 14:52 UTC
- DNS
- Resolves · checked 2026-11-05 09:02 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
- Phishing-host list fetched with the address
- Resolved to 5.161.23.223
- Latest DNS check
- Certificate
- Logged in Google ParcelYard2027h1, entry 456,083,032SHA-256 3ae05a38f081348d55d10f05d53fa7d7feeb3d39810f76f69a370b95a42f5003
- Brand
- OpenAI
- Addresses
- 5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
How certificate findings are selected
Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.
DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches OpenAI when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

