Suspicious

Phishings targeting ChatGPT

Suspicious and active websites

Phishings targeting Chatgpt

Suspicious and active websites

Active
6
New (7d)
2
Trend (7d)
—
Website
chatgpt.com
About
AIOpenAI's flagship chatbot. Phishing typically harvests credentials to resell ChatGPT Plus / Team subscriptions, hijack API keys tied to billing, or pivot into OAuth-connected SaaS apps via 'Sign in with OpenAI'.
Hosts
Cloudflare, Inc. (3) · Tencent Building, Kejizhongyi Avenue (1) · Amazon.com, Inc. (1)
Countries
United StatesUnited States (5) · Hong KongHong Kong (1)
TLS certs
WE1 (1) · R13 (1) · Google Trust Services (1)

Suspicious sites — confidence is not always 100%. Use for Threat Hunting or watchlists.

Last check (UTC) First seen (UTC) ▾ URL Screenshot Flags Details
2026-07-31 05:46 2026-07-31 05:46
https://chatgptdeutsch.io
Screenshot of chatgptdeutsch.io GSB Details
2026-07-31 01:30 2026-07-24 23:00
http://openai.defenders.workers.dev
Screenshot of openai.defenders.workers.dev TweetFeed Details
2026-07-31 01:30 2026-07-12 15:41
https://openai-online.net
Screenshot of openai-online.net urlscan Details
2026-07-31 01:30 2026-06-16 07:00
https://gemini.chatgpt-use.com
Screenshot of gemini.chatgpt-use.com TweetFeed Details
2026-07-31 01:30 2026-06-15 13:02
https://chatgpt0005.eu.org/blog
Screenshot of chatgpt0005.eu.org OpenPhish Details
2026-07-31 01:30 2026-05-31 03:57
https://openai-coin.com
Screenshot of openai-coin.com urlscan Details

Suspicious sites — confidence is not always 100%. Use for Threat Hunting or watchlists.

URL Screenshot Details
https://chatgptdeutsch.io
GSB 		Screenshot of chatgptdeutsch.io Details
http://openai.defenders.worke…
TweetFeed 		Screenshot of openai.defenders.workers.dev Details
https://openai-online.net
urlscan 		Screenshot of openai-online.net Details
https://gemini.chatgpt-use.com
TweetFeed 		Screenshot of gemini.chatgpt-use.com Details
https://chatgpt0005.eu.org/bl…
OpenPhish 		Screenshot of chatgpt0005.eu.org Details
https://openai-coin.com
urlscan 		Screenshot of openai-coin.com Details

AIHow to verify a real ChatGPT URL

  • Legitimate ChatGPT URLs always end in chatgpt.com (e.g. www.chatgpt.com, account.chatgpt.com). Anything else — including look-alike typosquats, hyphenated variations, or unfamiliar TLDs like .xyz / .top / .vip — is not ChatGPT.
  • The padlock icon proves TLS is active, not that the site is safe. Free DV certificates are issued to attackers in minutes; every active site listed above has a valid TLS certificate.
  • If you got the link from email, SMS, or social media, do not click it. Open chatgpt.com from your browser bookmark or type the domain manually.
  • Real ChatGPT pages almost never ask for credentials immediately after clicking from a message — treat any such redirect as a phishing attempt until the domain is verified.