go372833998[.]com

The domain go372833998.com was registered on 28 April 2026 and currently resolves to the Cloudflare address 188.114.97.3. HTTP requests to the host return a 200 OK status and the page presents the title “Minhkon29 AI Chat”. The site is protected by a Let’s Encrypt certificate issued under the E7 profile, and its authoritative nameservers are celeste.ns.cloudflare.com and rex.ns.cloudflare.com. Geolocation of the IP places the server in Canada and identifies the operator as Cloudflare, Inc.

Infrastructure signals suggest the domain is leveraging Cloudflare’s edge network to hide its true origin. The low Gridinsoft trust score of 0 / 100 indicates a lack of reputation, while the domain appears on a single security blocklist – PhishDestroy – which has flagged it as malicious. No detections were recorded on VirusTotal at the time of analysis, and the domain is listed in one AlienVault OTX pulse, confirming that external threat‑intel sources have observed related activity.

The combination of a generic AI‑chat page title and the presence on a phishing‑oriented blocklist points to a credential‑harvesting campaign that likely masquerades as an AI chatbot service. The registration information shows the domain was acquired through Fewmoretaps OU d/b/a Trustname.com, a registrar that has been used in prior malicious registrations, further supporting the phishing hypothesis. However, the exact payload, target audience, and any associated command‑and‑control infrastructure remain undocumented.

Defenders should add go372833998.com to local deny lists, monitor DNS queries for the domain, and inspect outbound traffic for connections to 188.114.97.3. Because the site uses a valid TLS certificate, TLS inspection may be required to view the payload. Continuous re‑scanning on multi‑engine platforms is advised to capture any future detections, and any credential submissions observed should be treated as compromised. The investigation remains active and under further review.