Criticalscore 76 · flagged Tuesday, September 15, 2026

openaiplus.online

Appeared in the .online zone on Tuesday, September 15, 2026; by the end of that day the census found active website. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

brand in the name
matched: openai
+30
free DNS provider
matched: dnsowl.com
+8
brand in page title, not in the name
matched: chatgpt
+20
form on a brand-styled page
matched: has_form
+18
Registrar
Nameserver provider
Nameservers
ns1.dnsowl.com, ns2.dnsowl.com, ns3.dnsowl.com
First-day state
active website
HTTP status
200
Page title
登录 · ChatGPT
Has a form
yes
Brand echoed
openai

Model opinions

Second opinionlooks like phishingtarget: OpenAIconfidence 62%· claude-opus-5

Page uses the OpenAI logomark, the title "登录 · ChatGPT" and an openai-containing domain to present a ChatGPT sign-in/registration flow, with email+password forms posting back to itself and a card-key (卡密) purchase funnel for 'credits' — unauthorised OpenAI branding used to harvest account credentials and payment; the self-built card-key reseller disclaimer makes a gray-market abuse reading possible but the branding is still deceptive impersonation.

First passlooks like phishingtarget: OpenAIconfidence 98%· claude-haiku-4-5

Domain name impersonates OpenAI ('openaiplus'), page title falsely claims to be 'ChatGPT' (登录 · ChatGPT), and the login form with email/password fields posts to itself with no offsite links—the sealed-room phishing pattern. The page displays ChatGPT branding (logo, 'ChatGPT' text) and solicits credentials under a typosquat domain, confirming credential-harvesting intent.

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Tuesday, September 15, 2026

Screenshot of openaiplus.online taken by the zone census on 2026-09-15

Same data as JSON: /api/zone/domain/openaiplus.online. This page is not indexed by search engines and does not link to the site it describes.