aisi4-app[.]i4-app[.]icu

The domain aisi4-app.i4-app.icu was registered on September 28, 2025 through Gname.com Pte. Ltd. and is currently offline after being taken down by the PhishDestroy takedown service. DNS resolution points to the IPv4 address 172.245.67.31, which belongs to the HostPapa hosting provider (AS36352) located in the United States. The authoritative name servers are a2.share-dns.com and b2.share-dns.net, both typical of shared‑hosting environments. An SSL certificate was observed on the adjacent address 172.245.67.50, indicating a possible certificate mismatch or use of a wildcard certificate that does not cover the exact hostname. The public web page, when it was reachable, returned the title "爱思助手", suggesting the site was intended to masquerade as a Chinese‑language assistant application, though no further branding or target information is available in the collected data.

Two of ninety‑five VirusTotal scanners flagged the domain, providing a modest but non‑trivial indication of malicious activity. The site appears on one external security blocklist, and Gridinsoft assigned a trust score of 0 out of 100, reinforcing the perception of high risk. No additional signals such as Safe Browsing, Open Threat Exchange, or other reputation feeds were present in the intelligence set.

Given the limited but consistent evidence—registered by a known registrar, hosted on a commercial shared platform, flagged by multiple anti‑malware engines, and associated with a zero‑trust score—defenders should treat any traffic to aisi4-app.i4-app.icu as hostile. Network security teams should block outbound connections to the IP 172.245.67.31 and to the domain itself at the DNS level. Email gateways should add the domain to phishing and malware block lists, and endpoint protection solutions should be updated to include the observed indicators. Because the site is offline, ongoing monitoring of the domain's registration status and any re‑appearance on public blocklists is advisable.