Scam Attacks Taking Advantage of the Popularity of the Generative AI Wave
AI summary · glm-5.3-flashSummaries by Vani AI
Unit 42 finds about 225 generative AI-themed domains registered daily since ChatGPT's launch, with nearly 29 percent suspicious, fueling scams and PUP delivery.
Palo Alto Networks analyzed new domain registrations containing generative AI keywords such as chatgpt, prompt, and sora since ChatGPT's November 2022 launch, observing around 225 GenAI-related registrations per day. About 28.75 percent of these domains are suspicious, a rate 22 times higher than for general new domains, with registration spikes aligning with milestones like Bing ChatGPT integration, the GPT-4 release, new GPTs, and OpenAI's Sora announcement. Over 72 percent of the domains use gpt or chatgpt keywords, and gpt domains show a 76 percent suspicious rate. Case studies cover PUP delivery, spam distribution, and monetized domain parking, with 35 percent of traffic to these domains directed at suspicious ones.
Key facts
- About 225 generative AI-related domains were registered daily since ChatGPT's November 2022 launch.
- 28.75 percent of GenAI domains are suspicious, a rate 22 times higher than general new domains.
- Registrations spiked around Bing ChatGPT integration, GPT-4 release, new GPTs, and Sora announcements.
- Over 72 percent of domains use gpt or chatgpt keywords; gpt domains are 76 percent suspicious.
- Case studies cover PUP delivery, spam distribution, and monetized domain parking; 35 percent of traffic hits suspicious domains.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 33115c.com | tbot[.]xyz Janoub-hightech[.]com Internationaljobsite[.]com 33115c[.]com Adversaries used ChatGPT-related URLs to spread spam mess |
| domain | bardassai.com | parking campaign we have identified involved nine domains: Bardassai[.]com Gemini-addons[.]com Gemini-agents[.]com Gemini-agi[.]com |
| domain | chatgpt0002.cn | gpt000[.]cn Chatgpt008[.]cn Chatgpt178[.]cn Chatgpt009[.]cn Chatgpt0002[.]cn Chatgpt188[.]cn Chatgptapp888[.]cn Chatgpt138[.]cn Chatgp |
| domain | chatgpt000.cn | [.]cn Chatgpt005[.]cn Chatgptapp000[.]cn Chatgptapp999[.]cn Chatgpt000[.]cn Chatgpt008[.]cn Chatgpt178[.]cn Chatgpt009[.]cn Chatgpt00 |
| domain | chatgpt005.cn | similar naming pattern: Chatgptproapp[.]com Chatgptios[.]cn Chatgpt005[.]cn Chatgptapp000[.]cn Chatgptapp999[.]cn Chatgpt000[.]cn Cha |
| domain | chatgpt006.cn | 002[.]cn Chatgpt188[.]cn Chatgptapp888[.]cn Chatgpt138[.]cn Chatgpt006[.]cn All domains are hosted by name servers from dnspod[.]net |
| domain | chatgpt008.cn | [.]cn Chatgptapp000[.]cn Chatgptapp999[.]cn Chatgpt000[.]cn Chatgpt008[.]cn Chatgpt178[.]cn Chatgpt009[.]cn Chatgpt0002[.]cn Chatgpt1 |
| domain | chatgpt009.cn | app999[.]cn Chatgpt000[.]cn Chatgpt008[.]cn Chatgpt178[.]cn Chatgpt009[.]cn Chatgpt0002[.]cn Chatgpt188[.]cn Chatgptapp888[.]cn Chatg |
| domain | chatgpt138.cn | 09[.]cn Chatgpt0002[.]cn Chatgpt188[.]cn Chatgptapp888[.]cn Chatgpt138[.]cn Chatgpt006[.]cn All domains are hosted by name servers fr |
| domain | chatgpt178.cn | 000[.]cn Chatgptapp999[.]cn Chatgpt000[.]cn Chatgpt008[.]cn Chatgpt178[.]cn Chatgpt009[.]cn Chatgpt0002[.]cn Chatgpt188[.]cn Chatgpta |
| domain | chatgpt188.cn | pt008[.]cn Chatgpt178[.]cn Chatgpt009[.]cn Chatgpt0002[.]cn Chatgpt188[.]cn Chatgptapp888[.]cn Chatgpt138[.]cn Chatgpt006[.]cn All do |
| domain | chatgptapp000.cn | attern: Chatgptproapp[.]com Chatgptios[.]cn Chatgpt005[.]cn Chatgptapp000[.]cn Chatgptapp999[.]cn Chatgpt000[.]cn Chatgpt008[.]cn Chatgp |
| domain | chatgptapp888.cn | pt178[.]cn Chatgpt009[.]cn Chatgpt0002[.]cn Chatgpt188[.]cn Chatgptapp888[.]cn Chatgpt138[.]cn Chatgpt006[.]cn All domains are hosted by |
| domain | chatgptapp999.cn | pp[.]com Chatgptios[.]cn Chatgpt005[.]cn Chatgptapp000[.]cn Chatgptapp999[.]cn Chatgpt000[.]cn Chatgpt008[.]cn Chatgpt178[.]cn Chatgpt00 |
| domain | chatgptios.cn | t and follows a similar naming pattern: Chatgptproapp[.]com Chatgptios[.]cn Chatgpt005[.]cn Chatgptapp000[.]cn Chatgptapp999[.]cn Cha |
| domain | chatgptproapp.com | s the keyword chatgpt and follows a similar naming pattern: Chatgptproapp[.]com Chatgptios[.]cn Chatgpt005[.]cn Chatgptapp000[.]cn Chatgp |
| domain | dnspod.net | Chatgpt006[.]cn All domains are hosted by name servers from dnspod[.]net and share the same common IP address in Hong Kong. This c |
| domain | gemini-addons.com | n we have identified involved nine domains: Bardassai[.]com Gemini-addons[.]com Gemini-agents[.]com Gemini-agi[.]com Gemini-super-intelli |
| domain | gemini-agents.com | involved nine domains: Bardassai[.]com Gemini-addons[.]com Gemini-agents[.]com Gemini-agi[.]com Gemini-super-intelligence[.]com Gemini-s |
| domain | gemini-agi.com | ns: Bardassai[.]com Gemini-addons[.]com Gemini-agents[.]com Gemini-agi[.]com Gemini-super-intelligence[.]com Gemini-superintelligence[ |
| domain | gemini-super-intelligence.com | om Gemini-addons[.]com Gemini-agents[.]com Gemini-agi[.]com Gemini-super-intelligence[.]com Gemini-superintelligence[.]com Geminisuperintelligence[.] |
| domain | gemini-superintelligence.com | ents[.]com Gemini-agi[.]com Gemini-super-intelligence[.]com Gemini-superintelligence[.]com Geminisuperintelligence[.]com Gpt-vision[.]com My-gpt-cpa |
| domain | geminisuperintelligence.com | ini-super-intelligence[.]com Gemini-superintelligence[.]com Geminisuperintelligence[.]com Gpt-vision[.]com My-gpt-cpa[.]com All these domains lead |
| domain | gptsotre.com | n Nov. 6, 2023, during which numerous related domains, like gptsotre[.]com , were registered. The breaking news about Sora, an upcom |
| domain | gpt-vision.com | emini-superintelligence[.]com Geminisuperintelligence[.]com Gpt-vision[.]com My-gpt-cpa[.]com All these domains lead traffic to moneti |
| domain | internationaljobsite.com | Ketlenpack[.]online Oha-chatbot[.]xyz Janoub-hightech[.]com Internationaljobsite[.]com 33115c[.]com Adversaries used ChatGPT-related URLs to spr |
| domain | janoub-hightech.com | s from this campaign: Ketlenpack[.]online Oha-chatbot[.]xyz Janoub-hightech[.]com Internationaljobsite[.]com 33115c[.]com Adversaries used |
| domain | ketlenpack.online | e identified the following five domains from this campaign: Ketlenpack[.]online Oha-chatbot[.]xyz Janoub-hightech[.]com Internationaljobs |
| domain | msftchatgpt.com | w domains where many of them contain both trademarks (e.g., msftchatgpt[.]com ). Another significant spike occurred on March 14, 2023, |
| domain | my-gpt-cpa.com | igence[.]com Geminisuperintelligence[.]com Gpt-vision[.]com My-gpt-cpa[.]com All these domains lead traffic to monetization services a |
| domain | oha-chatbot.xyz | lowing five domains from this campaign: Ketlenpack[.]online Oha-chatbot[.]xyz Janoub-hightech[.]com Internationaljobsite[.]com 33115c[. |
| domain | sedodna.com | d traffic to monetization services at sedoparking[.]com and sedodna[.]com through different types of redirections, including server |
| domain | sedoparking.com | All these domains lead traffic to monetization services at sedoparking[.]com and sedodna[.]com through different types of redirections |
| sha256 | bad2294523c7abd42c3184d1e513bf851cb649a4acd9543cdf5d54d21f52c937 | roid, PC and iOS platforms. The Android APK with the SHA256 bad2294523c7abd42c3184d1e513bf851cb649a4acd9543cdf5d54d21f52c937 requests access to sensitive data on the victim device, ind |
From the original article
8 min read at unit42.paloaltonetworks.com
In this post, we explore the evolution of domain registration and network attacks associated with terms related to generative AI (GenAI). These trends are strongly correlated with the key milestones and developments in GenAI such as the launch of ChatGPT and its integration into the Bing search engine – and the buzz of interest around these events.
By Reethika Ramesh, Ruian Duan, Zhanhao Chen · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.