goswmertyeonijksqdfh[.]com

Analysis of goswmertyeonijksqdfh.com shows that the domain was registered on 23 December 2025 through Ultahost, Inc. and has been assigned the Cloudflare nameservers kenia.ns.cloudflare.com and randall.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which is part of the Cloudflare network (AS13335) and geolocates to the United States. The site does not present an SSL/TLS certificate, and an HTTP request returns a minimal "Index of /" page title, indicating that only a directory listing is exposed. The domain currently reports an offline status, and the host has been taken down by the sinkhole service PhishDestroy.

Reputation scoring from Gridinsoft assigns a trust score of 0/100, the lowest possible rating. AlienVault’s Open Threat Exchange lists the domain in two separate threat pulses, confirming community‑wide awareness of malicious use. VirusTotal analysis shows that 11 of 93 scanned security vendors flagged the domain as malicious, reinforcing the suspicion. Additionally, the domain appears on one public security blocklist, and the PhishDestroy feed has explicitly blocked it.

Given the convergence of low trust scores, multiple vendor detections, and community‑reported intelligence, the infrastructure is consistent with a generic phishing operation. Defenders should add 188.114.97.3 to network‑level deny lists, enforce DNS‑based blocking of goswmertyeonijksqdfh.com, and monitor any newly observed subdomains that resolve to the same Cloudflare IP range. Continuous re‑evaluation of the IP reputation is advised, as Cloudflare may host unrelated legitimate services on the same address space. Organizations using URL filtering should ensure that the domain is present in their blocklists, and endpoint security solutions should treat any connections to the host as high‑risk.