ai-chatbot-starter-39otfi6ibf[.]edgeone[.]dev

This domain, ai-chatbot-starter-39otfi6ib.edgeone.dev, is identified as a credential theft operation targeting users of AI-based chatbot platforms. The site mimics legitimate multi-model AI chatbot interfaces, tricking visitors into entering sensitive login credentials or personal information under the guise of accessing advanced AI features. Once submitted, these credentials are harvested by threat actors for unauthorized account access, financial fraud, or further phishing campaigns. Analysis indicates the domain is flagged by 11 out of 95 security vendors on VirusTotal, confirming its malicious nature. Infrastructure review reveals it resolves to the IP address 43.174.247.29 and was registered through Aceville Pte Ltd. The site employs a valid SSL certificate issued by DigiCert, Inc., which may lend a false sense of legitimacy to unsuspecting users. Additionally, the domain appears on two security blocklists and is reported to use HTTP Strict Transport Security (HSTS), a technique occasionally exploited to evade basic security checks. If you visited ai-chatbot-starter-39otfi6ib.edgeone.dev or entered any credentials, immediately reset passwords for all accounts accessed from the same device. Enable multi-factor authentication (MFA) where available to mitigate unauthorized access. Scan the device for malware using updated security tools, as credential theft sites may deploy additional payloads. Monitor financial and account activity for signs of compromise, such as unauthorized logins or transactions. Report the incident to relevant security teams or platforms to assist in broader mitigation efforts.